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SIRU DEVELOPMENT FINAL REPORT 
ABSTRACT 

This report presents a complete description of the development and initial 
evaluation of the Strapdown Inertial Reference Unit (SIRU) system sponsored by the 
NASA Johnson Space Center under Contract N AS9-8242. 

The SIRU configuration is a modular inertial subsystem with hardware and 
software features that achieve fault tolerant operational capabilities. The SIRU 
redundant hardware design is formulated about a six gyro and six accelerometer 
instrument module package. The modules are mounted in this package so that their 
measurement input axes form a unique symmetrical pattern that corresponds to 
the array of perpendiculars to the faces of a regular dodecahedron. This six axes 
array provides redundant independent sensing and the symmetry enables the 
formulation of an optimal software redundant data processing structure with self- 
contained fault detection and isolation (FDI) capabilities. 

This report consists of four volumes. 

Volume I, System Development, documents the system mechanization with the 
analytic formulation of the FDI and processing structure; the hardware redundancy 
design and the individual modularity features; the computational structure and 
facilities; and the initial subsystem evaluation results. 

Volume II, Gyro Module, is devoted specifically to the Gyro Module, the inertial 
instrument and its digital strapdown torque-to-balance loop, the mechanical, thermal, 
and electronic design and function, test procedures and test equipment and 
performance results and analysis. 

Volume III, Software, documents the basic SIRU software coding system used 
in the DDP-516 computer. The documentation covers the instrument compensation 
software, reorganizational and FDI processing, and the inertial attitude and velocity 
algorithm routines as well as servicing, input / output, etc. software. 
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Volume IV, Accelerometer Module, is devoted specifically to the Accelerometer 
Module, the inertial instrument and its digital strapdown torque- to- balance loop, 
the mechanical, thermal and electronic design and function and performance results 
and analysis, as it differs from the Gyro Module, 

In addition to this report, SIRU Utilization Report R-747, has been issued 
documenting analyses, software and evaluation activities in the application of advanced 
statistical FDI algorithms, calibration and alignment techniques to the SIRU system. 
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1 ,0 Introduction 


This SIRU Development Final Report is the first of two SIRU system final 
reports. The second, SIRU Utilization Report R-747, is summarized briefly in this 
introductory section. 

The SIRU Development Final Report provides an overview of the SIRU project, 
including historical background, design concept, hardware mechanization, software, 
test equipment, reliability and initial test results. In general, it describes the 
activities and achievements accomplished during the period from May, 1968 through 
November, 1971. At that time a complete operational system had been functional 
for five months and both hardware and software had been debugged and consistent 
system operation demonstrated. The report is presented in four volumes as follows: 

Volume I - System Development 

Volume II - Gyro Modules 

Volume III - Software Documentation 

Volume IV - Accelerometer Module (CONFIDENTIAL) 

Volume I contains a complete description of the SIRU system concentrating 
on the system hardware but covering in adequate detail system mechanization, 
computational software and facilities, test facilities, test results and a reliability 
appraisal. Program milestones and conclusions and recommendations are also 
included. 

Volume II presents in greater detail the design, operation and test results 
applicable to the gyro modules and Volume IV provides the same information 
applicable to the accelerometer modules. Volume III provides a documentation of 
the base-line system software including assembly listings and flowcharts. 

The SIRU Utilization Report presents the results of the additional analysis, 
software development and testing activities provided for under Amendment 7S to 
the basic SIRU contract. The report is presented in three volumes as follows: 

Volume I - Theory, Development and Test Evaluations 
Volume II - Software Documentation 
Volume III - System Log 
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Volume I contains a complete description of the theory, analysis, implementation 
and test results for each of the tasks, namely: 

1. Statistical Failure Detection Isolation Classification and Recompen- 
sation (FDICR) 

2. Error Source Propagation Characteristics 

3. System Single Position Self-Calibration 

4. SIRU Self- Alignment (Gyro Compassing) 

5. Local Level Navigator Performance Demonstrations 

Volume II provides documentation for the additional or modified software 
including assembly listings and flowcharts. Volume III contains a log of significant 
system events from the beginning of the system testing program. 

1 .1 Background 

A major requirement for guidance, navigation, and control systems designed 
for future spacecraft and aircraft applications is high reliability. As a means for 
fulfilling this requirement, attention in recent system studies has been focused on 
the use of redundancy concepts with fault tolerant features to achieve an order of 
magnitude or better improvement in reliability. 

In the Apollo spacecraft, each "primary’' system was complemented by a 
"backup 11 system which had limited mission- mode capabilities. For future space 
missions this concept, predicated on a fail-safe return to earth, will not suffice; it 
fails to provide the necessary reliability and operational capabilities for extended 
missions. In commercial and military aircraft, duplex or triplex redundancy in 
guidance, navigation, and control systems has become commonplace. In these 
applications failure isolation decisions and system reconfiguration selection are 
for the most part assigned to the human operator. Advanced guidance and navigation 
systems to meet improved air traffic control requirements undoubtedly will 
incorporate automatic failure detection and adaptation — especially in critical 
guidance phases. 

Obtaining an optimum redundant guidance and navigation system can be 
approached in several ways. A basic decision, however, will involve the geometric 
arrangement of the inertial sensors. The choice is between instrument redundancy 
along common orthogonal axes and a non-ortho gonal array of instruments; in either 
case the objective is to provide a comprehensive array of measurement data. In 
both approaches the mechanization should be free from single point failure 
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possibilities, and provide a self-contained failure detection, isolation and processing 
reorganization capability. The operation of the failure detection and isolation 
technique must achieve time critical system reliability by eliminating faulty data 
from instruments or their electronics before the faulty measurements data affects 
successful mission performance, and the remaining data and processing structure, 
after reorganization, must have satisfactory mission performance capabilities. 

1.2 Historical Background 

On May 7, 1968 the Charles Stark Draper Laboratory* at the Massachusetts 
Institute of Technology submitted a Technical Proposal, in response to NASA RFP 
#BG 731-47-8-533P, to the Manned Spacecraft Center of the National Aeronautics 
and Space Administration for the design, analysis and development of a redundant 
Strapdown Inertial Reference Unit (SIRU), This unit was intended to replace 
corresponding assemblies in the Primary Guidance Navigation and Control System 
(PGNC) which the laboratory had designed and developed for the Apollo program. 

This contractual activity marked the culmination of a research and development 
effort to determine and define the fundamental aspects of redundant strapdown inertial 
guidance, navigation and control systems. The redundancy concept was based on a 
dodecahedron configuration for the inertial instruments that had been proposed and 
delineated in an MIT masters thesis published in 1967. During the next two years 
under NASA sponsorship (contract NAS 9-68 23) a base of supporting strapdown 
technology was created including an inertial grade high torque gyroscope, improved 
torque-to-balance servo techniques and higher order computational algorithms. 

As stated in the May 1968 Technical Proposal, the purpose of the SIRU effort 
was "to design, assemble, and test an inertial reference unit suited to the operational 
reliability requirements of long-term manned space flights. Redundant, structure 
mounted inertial components (strapdown) should be used to provide high reliability 
and freedom from operational constraints (e.g., ginibal lock)". 

The SIRU was to be configured to interface with the spacecraft planned for 
the Apollo Application Program (since modified and renamed Skylab). Specifically, 


The former Instrumentation Laboratory of the Department of Aeronautics and 
Astronautics at M.I.T, 


"A Non-Orthogonal Gyro Configuration", Jerold P. Gilmore, T-472, 
Instrumentation Laboratory, MIT, January, 1967, 
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the SIRU would replace the Apollo PGNC system Inertial Measurement Unit, the 
Coupling Display Unit, and the inertial section of the Power and Servo Assembly, 
The new assemblies would interface with the Apollo Guidance Computer and then 
the spacecraft to achieve fully redundant guidance, navigation, and control. 

Work under Contract NAS 9-8 242 commenced June 27, 1968. The Statement 
of Work specified that the contracts purpose was to develop and deliver one SIRU, 
whose production version would "meet the reliability requirement for long-term 
manned space flights." The reliability requirement was defined as "the capability 
to perform a . 120-day mission with a .999 mission success probability and a one-half 
hour reentry phase at the end of 120 days with a .9999 mission success probability." 

The SJ.RU was to consist of an Inertial Component Sensor Assembly with the 
associated electronics and power supplies necessary to meet the interface 
requirements. A Digital Computational Assembly package to verify the operational 
capability of the modified Guidance,' Navigation and Control system was also 
prescribed. As a design goal, the complete package (including associated hardware 
and harnesses) was to weigh less than 80 lbs with a power requirement of less than 
250 watts. 

1 . 3 Development Summary 

The SIRU system consists of a Redundant Instrument Package (RIP) and an 
Electronics Assembly (EA). The geometric redundancy concept ls mechanized in 
the Redundant Instrument Package, which contains six single degree-of- freedom 
gyroscope modules and six linear accelerometer modules. Geometric redundancy 
is achieved by using a non- orthogonal mounting configuration in which the instrument 
input axes (IAs) are oriented to correspond to the array of normals to the faces of 
a dodecahedron. Fig. 1.3.1. This arrangement yields a unique symmetry in which 
all instrument input axes are at a spherical angle (63.4°) from each other. 

In the particular implementation used, pairs of gyro or accelerometer axes 
lie in the orthogonal planes of a reference triad and are displaced about the principle 
triad axes by an angle. This symmetry yields optimal redundant reorganizational 
data processing with minimum error propagation. Moreover, by means of instrument 
output comparisons, self-contained failure isolation of up to two out of six of both 
instrument types is achieved and a third failure of each may be detected. With the 
aid of additional diagnostics, the processing structure still allows continued operation 
after three failures on both of the six gyro and six accelerometer measurement 
axes. 
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Fig. 1. 3. 1 Instrument Input Axes Orientation Relative to 

The Instrument Frame Triad and the Dodecahedron 

The RIP is an assembly of gyro and accelerometer modules in which each 
module is a prealigned a 2 id normalized assembly. The modules are interchangeable 
and Include the instrument and its pulse torque-to-balance control electronics, 
temperature controller, etc. The gyro module is scaled to be compatible with a 1 
rad/sec input and the accelerometer module is compatible with an Apollo 19 g*s 
capability. Redundant concepts are also applied in the supporting EA (power supplies, 
clock and scalers, etc.). The levels of redundancy used in the EA are based upon 
the relative reliability of functional circuits and circuit isolation concepts. For 
example, to maintain the inherent reliability of the instrument configuration such 
features as triple clock voting, dual scaler channels and six functional power supplies 
are employed. 
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PROBABILITY 


With respect to reliability, insight into the relative merit of different sensor 
geometric configurations is provided by a normalized reliability comparision. The 
variation of probability of mission success with normalized time for several sensor 
arrangements is illustrated in Fig. 1,3*2. Time (t) is normalized by the mean- 
time-between — failures (MTBF) of a sensor axis, i.e., the instrument and its 
functionalized electronics. In the illustration, all system sensor axes are assumed 
to have the same MTBF. For reference, a reliability curve is shown for a conventional 
orthogonal triad package of three sensor axes. The other curves correspond to 
systems with self-contained failure isolation features, i.e., three triads (where 
mission success is attained by majority agreement); a single triad with three 
instruments on each axis (with majority agreement per axis); and the dodecahedron 
array (which allows the failure of any two axes). Note that a marked reliability 
advantage for the SIRU configuration is clearly observable. Further, if external 
failure isolation is assumed so that operation continues until all three triad systems 
fail or a fourth SIRU axis fails, SIRU reliability is 0.999 compared to 0.98 fora 
normalized time (t/T) of 0,1. It is important to note that redundancy alone does 
not supply a complete solution to the problem of system reliability. Each element 
in the system must be selected and conservatively applied in a manner that is 
consistent with the environment and the mission duration; there is no substitute for 
quality engineering. Similarly, an element's statistical MTBF of one million hours 
does not preclude its failure, on a random or defect basis. Thus, the system must 
be configured to avoid total failure resulting from the failure of a single element. 



Fig. 1. 3. 2 Mission Success Probability 


6 




A Digital Computational Assembly (DCA) design was formulated concurrently 
with the development of the inertial sensor and electronics packages, A representative 
engineering design was developed to fulfill the processing and strapdown algorithm 
system requirements and a breadboard unit built. The DCA design concept was 
based on a general purpose computer with duplex processors, memories and I/O 
sequencers. It was configured to achieve the system high reliability requirements 
and it incorporated multiple error checking, single instruction restart capabilities, 
micro-programmed sequence generation, and the use of a serial time multiplexed 
input/output. The fabrication of a prototype DCA was not undertaken in this program 
due to cost considerations, A report describing the work performed and results 
achieved under the DCA task has been published as MIT Engineering Report E-2590, 
December, 1970. 

A general purpose computation and control facility was developed and expanded 
to support system RIP and EA testing, data reduction and analysis as well as 
operational software development and evaluation. This facility was also used for 
the development and coding of DCA software. It was developed around a general 
purpose commercial mini-computer, the Honeywell DDP-516, which is software 
compatible with the Honeywell 601 airborne computer. The DDP-516 is a 
representative state-of-the-art general purpose machine, employing a 16-bit word 
with a memory cycle time of 0.96 microseconds, a high-speed arithmetic package 
and 16,384 words of core memory. The peripherals used include: two disc drives; 
a teletype unit, a CRT display; a high-speed paper tape reader and an incremental 
magnetic tape unit. 

Ground support equipment (GSE) consisting of a GSE console with power 
supplies and monitoring and control capabilities, an Interconnect Box and Table 
Junction Box for table interconnections across the test table slip rings, a RIP test 
box and an auxiliary monitor console for signal monitoring and test table control 
functions were assembled and combined with the other system hardware. 

The computer was interfaced with the SIRU outputs and the test table encoder 
and is operated with the system on-line and in real-time. The following specific 
software has been developed and debugged and are routinely operating with the SIRU 
system. 

1. Interface software to operate in real-time with the SIRU outputs and to 
display and record the desired computational algorithm outputs. 

2, Strapdown attitude and velocity algorithms compatible with general 
purpose computer structure and speed. 
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3. Static and dynamic instrument error model (e.g., BD, AD1A, etc., SF 
and OA coupling, etc.) compensation routines that are also compatible 
with failure conditions, (e.g., gyro compensation independent of acceler- 
ometer failure status, etc.). 

4. An adaptive instrument data processing structure using least- squares 
triad body rate and accelerometer estimation with restructuring based 
on instrument failure status i.e., by reducing thenumberof dodecahedron 
measurement axes that are processed (six, five, four or three axes) to 
reflect the current failure status. A least- squares triad solution is 
thereby obtained that uses only those measurement axes that are 
performing to an acceptable standard. 

5. A failure detection and isolation (FDI) structure based onthetotal squared 
error (TSE) ratio test and parity equations to provide sequential FDI of 
any two gyro or accelerometer soft performance failures( equivalent 
to approximately ten times the nominal uncertainties). Isolation 
ambiguities are limited to two certain simultaneous failures of the same 
measurement type that have equivalent failure levels in one FDI test 
period. FDI is effected prior to every algorithm interaction cycle. 
Thus if a hard failure (catastrophic in nature, e.g., full on output) or a 
soft failure (error characteristics several orders of magnitude above 
the FDI threshold levels) occurs, it is possible to detect and isolate it 
prior to a single iteration period (10 ms at 100/sec) with no error 
propagation in the attitude or velocity algorithm outputs. In both cases 
soft and hard failure detection of a third failure is achieved. 

6* System static and dynamic instrument calibration programs that acquire 
and process raw data in the calibration test sequence and generate 
printouts in engineering units as well as calibration loads in machine 
language for the real-time compensation routines* 

7. Programs to provide algorithm output recording and test programs for 
performance and simulation testing. 

8. A disc operated system with assembler, compiler, and program editor 
providing self-contained development and debugging of operational and 
test software suitable for the DCA as well as for the DDP-516. 

9. Programs for fine grained analysis of performance test results on the 
IBM 360. 


A soft failure is performance degradation requiring measurement comparisons to 
detect, A hard failure is defined as one which is generally catastrophic in nature, 
probably could be detected and isolated by Hardware Self Test (BITE) techniques, 
and tends to be gross in nature. 
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In summary, theSIRU program accomplished the following major achievements. 

1. Implemented in hardware a redundant strapdown inertial system based 
on the dodecahedron symmetry, incorporating effective FDI and efficient 
automatic redundancy management. 

2. Designed, fabricated and assembled a modularized, redundant instrument 
package consisting of six normalized gyro and accelerometei' modules 
supported by an EA possessing interchangeable functional modularity 
consisting of six axes power supplies, dual power bus and triple clock 
redundancy to eliminate single point failure sources. Feasibility of 
interchangeable modularity was successfully demonstrated. 

3. Developed and demonstrated software to provide redundancy management 
and strapdown processing including automatic fault detection and 
isolation, static and dynamic instrument compensation, attitude and 
velocity algorithms, self alignment and calibration and real-time data 
acquisition and analysis. 

4. Demonstrated a full-up and continuously operating system reliability 
record covering a period in excess of 20,000 hours since July, 1970. 

5. Demonstrated over this period operational capabilities and performance 
consistent with and exceeding the requirements for the j1 fail operational/ 
fail safe concepts now specified for the Space Shuttle even though its 
intended application was for the earlier Apollo Applications (Skylab) 
mission. 
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2.0 System Mechanization 


This section describes in detail the mechanization of the strapdown redundant 
system including normal processing and failure detection and isolation (FDI) 
techniques. Software requirements including compensation programs are defined. 
Analyses of error propagation and resulting performance forecasts are presented. 
The first half of the section deals with all these elements as they apply to the geometric 
redundancy and the second half shows the extension of the concept to the electronics 
design. 

2.1 Computational Functional Flow 

2.1.1 Redundant Instrument Processing 

The measurement data, derived from the gyros and accelerometers whose 
input axes are colinear with the dodecahedron vectors A through F in Fig. 1. 3, 1 in 
Chapter 1, must be related to a reference triad, XYZ. For a gyro set, the orientation 
yields a relationship between the angular rate inputs (W) about the triad axes and the 
gyro measurements (m) that may be expressed in matrix form in terms of the geometry 
as: 


m = Hb 


( 2 . 1 ) 


where 

b T . [w x w Y w^ 

= pm m, m m , m mJ 
— LabcdefJ 

"s - s c co o"' 
o o s -s c c 

c co o s -s„ 

C r r? l/2 

c - cos r ■ ) = 0.851 

1 r"F l/2 

s = sin ( 5 1Q Nr5 ) = 0.526 

These relationships reflect the dodecahedron configuration shown in Fig. 1.3.1. 

In the specific mechanization adopted for SIRU the Y axis is reversed compared to 

the dodecahedron which introduces sign changes in the equations. For the SIRU 

T 

configuration the corresponding matrix H is given by: 
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-s -c “C o o 

o “5 & c -c 

c o o s 

All the following equations in this volume are representative of this specific 
SIRU configuration. As seen from the equation, each instrument provides a measure 
of redundant data, e. g. , instruments A, B, C, and D sense a component of input 
along the X triad axis. By algebraic solution of the equations, equivalent triad axis 
rate or acceleration solutions can be obtained from any three gyros or accelerometers. 
Subsequent discussion illustrates that it is possible to isolate up to two failures of 
either type instrument and to detect a third failure through self-contained instru- 
ment output comparisons. v 

The processing structure used to obtain equivalent triad solutions from the 
dodecahedron array corresponds to a weighted least- squares solution form: 

b = (H T £ * 1 H)' 1 H T 4 j m (2.2) 

where £> is defined as the "best" triad solution estimate and ^ _1 corresponds to a 
diagonal 6*6 matrix whose terms represent the individual instrument variances. 
This solution provides a best estimate where both the geometric properties of the 
configuration and the individual instrument performance statistics are considered. 
For the dodecahedron array the computational implementation allows the selection 
of the appropriate triad solution in accordance with the operational status of the 
instruments in that 0can be modified to reflect either degraded or failed instrument 
performance. However, for efficient computational usage and time-critical decision 
and error propagation minimization, only a n go-no go" criterion has been implemented 
(a study to determine the feasibility of generating continuously a weighted least- 
squares estimate in an adaptive fashion has been conducted). Thus, processing 
reorganization is achieved by replacement of ^ ^ by a status matrix, X , in which 
all diagonal elements are unity when all instruments perform satisfactorily • By 
setting the appropriate elements to zero when failures are detected, a least- squares 
triad solution can be defined for any combination of instruments (i.e., 5, 4, and 3 
gyro or accelerometer combinations). (The actual processing matrices appropriate 


An additional contract task documented in Report R-747 covered the implementation 
of a statistical approach which, when combined with the current X implementation, 
provides higher resolution FD1 using a recursive statistical algorithm which also 
classifies the fault (mean or variance change) and if the fault corresponds to a 
stable mean performance change, recompensates it. 
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for each combination of gyros or accelerometers are presented in Appendix A), In 
the computer mechanization, this approach is implemented by storage of common 
parametric elements that may be assembled to form the appropriate least- squares 
solution based on the status of the instruments, X . This structure is regenerative 
in that, if instrument ,r healing M is observed in the failure isolation process, the 
instrument may be reinstated. Thus, the failure isolation criteria enables adaptive 
data processing. 

As noted previously, the self-contained FDI to be discussed in subsequent 
paragraphs illustrates that the dodecahedron symmetry enables isolation (determina- 
tion of the faulty measurement axes, Xj, Aj) and thereby automatic processing 
reconfiguration for up to two of either type of instrument axes failures through 
self-contained output comparisons. In addition, dependent upon the order and 
magnitude of failures in a sequence of failures, self-contained isolation of a third 
failure is also achieved. Under all circumstances self-contained detection of a 
third failure of the same type measurement axis is provided* External monitors 
may also be used to provide additional X status data to allow continued operation 
after as many as three gyro or accelerometer axes failures. 

The advantage of the dodecahedron self- detection and isolation capabilities is 
clearly illustrated when one considers that a system employing duplex instrument 
redundancy on orthogonal axes experiences total failure with two gyro or two 
accelerometer failures on the same axis, and self-contained isolation of performance 
degradation between two instruments on the same axis is not possible. Even with 
three independent triads, only one fault can be isolated when axis-by-axis voting is 
precluded (as when the triad orientations are not precisely aligned with respect to 
each other or if a fault occurs in a triad system that causes multiple failures in 
that subsystem). Using triple component orthogonal redundancy in a single system 
with failure isolation by instrument "voting 11 between the three instrument signals 
on the same axis provides limited capability, A second failure on the same axis 
cannot be isolated. TheSIRU skewed configuration yields the most efficient redundant 
use of six single- degree- of-freedom measurement axes for failure isolation and 
reliability improvement. 

In principle, any six- instrument, skewed configuration possesses similar 
redundant measurement and failure isolation capabilities. The advantage of the 
dodecahedron array results from its unique symmetry, whereby the six measurement 
axes are spherically distributed with equal angles between all axes. This feature 
minimizes geometric error amplification, simplifies failure isolation and optimizes 
the response characteristics to provide equalized performance at all attitudes. 


* 


\ 
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Independent studies by Weinstein \ have demonstrated that equivalent perform- 
ance is not attainable with triads that, are rotated with respect to each other to 
obtain a six axes measurement array. 

The relative performance of the SIRU configuration under various failure 
conditions may be identified clearly by comparing the SIRU reference triad solution 
statistics to the corresponding statistics for an operational three axis system. In 
each case, all instrument axes are assumed to have identical and independent 
measurement error characteristics. The statistical performance characteristics 
of the failure-free, three axis system are defined as having a standard measurement 
deviation of or along any axis and a total three-dimensional rss measurement deviation 
of (3) ' a. In comparison, when all six axes of SIRU are operational, the error 
statistics of its triad solution provide an axis standard measurement deviation of 

l/o 

0.707cr and an rss system deviation of (1.5) tr. Similarly; deviations for the SIRU 
triad solutions for the various five, four, and three instrument combinations may 
also be compared to the basic triad’s statistics. These combinations represent 
SIRU performance, with failed instruments detected and isolated, i.e., the failed 
axes no longer being used in the triad solution processing. 

In general, the error propagation of a non-orthogonal array with instruments 
deleted is such that its triad solution performance statistics reflect both the reduction 
in measurement data and the deterioration in geometry. Thus, dependent on the 
geometric positions of the deleted (failed) axes, the solution tends to have a maximum 
standard deviation along a specific axis (worst- case) and certain failure combinations 
have more pronounced rss error amplification than others. However, as illustrated 
in Table 2.1.1., SIRU error propagation is bounded and performance is not significantly 
affected by processing with reduced instruments. 

Table 2.1.1 

SIRU Performance with Instrument Failures. 

Vera UP. 

An Operational Triad System 


Instrument 

Failures 

Standard Deviation 
(Worst-Case Axis 
Solution) 

Ratio of Deviation 
(SIRU Solution to 
a 3 -axis System) 

None 

0. 707a 

0. 707 

1 (6 Combinations) 

0. 927a 

0. 816 

2 (15 Combinations) 

1. 349a 

1. 000 

3A (10 Combinations) 

1. 349a 

1. 176 

3B <10 Combinations) 

2. 890a 

1. 902 


Weinstein, Warren D. „ Optimum Skew Angle Between Redundant Inertial Systems, 
Grumman Aerospace Corporation. Bethpage, L, I. , N. Y. 
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The first column of Table 2.1.1 corresponds to the S1RU processing status, 
i.e., operation with all instruments, down to combinations of failures on three 
instrument axes. For each of these states, the table shows the SIRU worst-case 
single axis triad solution standard deviation and the ratio of the SIRU solution rss 
deviation to an equivalent triad system rss deviation. Note that SIRU performance 
with one failure is statistically better than an unfailed triad system and for all 
two-failure and ten three-failure combinations performance is essentially identical 
to an unfailed triad. For the remaining worst three-failure combinations, the 
maximum single axis solution standard deviation in comparison to a good triad axis 
standard deviation degrades by a factor of three while the corresponding total rss 
performance degrades by only a factor of two. 

2.1.2 Failure Isolation 


The self-contained failure isolation algorithm is based upon a simple compar- 
ison of measurement outputs- The unique symmetrical properties of the array allow 
one to implement two different but correlated FDI algorithms. One algorithm is 
based on the development of a series of "parity equations" and the other on a set of 
equations derived from the conical representation of the dodecahedron. Both 
algorithms are directly related; for example, the conical equation representation 
for the two- failure case is identical to the parity equations. The parity equations 
consist of a series of 1 5 equations, each equation representing a comparison of 
four measurements. All the equations will have a zero output (e) if all instruments 
are operating properly. The derivations of these equations are presented in MIT/lL 
Report T-472, A Non-Orthogonal Gyro Configuration by J. Gilmore, January, 1967. 
Table 2.1.2 lists the 15 equations. Each m term in the equations corresponds to an 
accumulated 0 count or velocity over some comparison interval. If, however, an 
instrument along A has malfunctioned, Eqs. 2.1 through 2.10 will show a non- zero 
total, while Eqs. 2.11 through 2.15 equate to zero, thereby isolating the failure. If 
a second instrument failure occurs, inspection of the remaining equations (2.11 
through 2.15) allows another level of failure isolation. If a third failure occurs and 
none of the equations show a zero total, the failure is detected but not isolated. 

The conical technique was originally synthesized in the computational software, 
but parity equations were subsequently used for the third- fail detect function and in 
the statistical FDI algorithms described in the SIRU Utilization Report Volume II, 
R- 747* The conical technique is displayed in Fig. 2.1.1. Note that each of the five 
vectors (B, C, D, E, F) is symmetrically displaced in a conical array about the 
central vector A. This relationship is identical for all orientations because of the 
symmetry of the dodecahedron array. 
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tan 2a - 2 
cos 2a 


Fig. 2. 1. 1 Conical Representation of Dodecahedron Normals 


F • A cos ?a 
Or 

a ( 8 + . . . + FI 
5 C0S2a 


Table 2. 1. 2 SIRU Parity Equations 


No. 

Instruments 

1 

ABCD 

2 

ABCE 

3 

ABCF 

4 

ABDE 

5 

ABDF 

6 

ABEF 

7 

ACDE 

8 

ACDF 

9 

ACEF 

10 

ADEF 

11 

BCDE 

12 

BCDF 

13 

BCEF 

14 

BDEF 

15 

CDEF 


Note: m 

a 

c 


(m a - m fe ) c + (m c + m d ) s = If! 

<m b - m c ) c - (m a + m g ) a = Kl 

-(m + m ) c + (m, + m.) s = IQ 

a c b f 

-(m + m ,) c + (m, + m ) s - 1*1 
ad be 

(m b - m d ) c - (m a + m^) s = 14 

<m e + m f ) c - (m a + m b > s ~ N 

(m^ - rn £ ) c + (m a - m c ) S = If I 

(m c - m f ) c + (m & - m^) s - |*| 

{m^ - m^) c + <m c - m p > s = K| 

(m - m ) c + (m , - m f ) s - 1*1 
a e d i 

(m^ + m e ) c - (m b + m^) s = |* | 

-<m , + mj c + (m, + m ) £ - I* | 
d I D<f c 

{ - m ) c - ( rn + m -) s = I* 1 
be ci 

(m b - m f ) c - (m d + m e > s - If I 

(rn - m ,) c + (m - m ) s = i*l 
c d el 


measurement of axis A accelerometer or gyro 
cos (at) 


s = sin (a) 

€ = Threshold Level 
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Using spherical representation one can directly derive the relationship between 
each vector and the central vector A: 


m, - rn cos 2 ct 
d a 


m* - m cos 2a 
f a 


(2.3) 


where: 


cos 


2a = n /72 


When all six instruments are assumed to be operating, six equations, Eq. 2*4, are 
obtained by considering each vector A, B. . . , F and the corresponding conical array 
of the other five vectors that surround it: 

E a = |'m a - k/ 072 (m b - m c - m d + m e + m f )j 


E. 


[ m b - n/oT 2 (m a + m c + m d + m g + m f )j 
[ m c - sl0.2 (-m a + m fe + m d - m e + xn f )J 
= |m d - s]072 (-m a + m b + m c + m e - m f )j 
[ m e - *^2 (m a + m b - m c + m d - m f )j 

f = [ m f - (m a + m b + m c ~ m d " “e’j 


A 

E, 


A 

E d = 


A 

E e ' 


(2.4) 


For each case the individual equations, Eq. 2.3 above, are then combined. For 

A A 

example E^ in Eq. 2.4, corresponding to the A vector, is derived by determining A 
from Eq. 2.3, 


A = 


m, - m - m i - m - m r 
b c d e f 

5 cos 2 a 


5 cos 2 a 


n/72 


<2. 5) 


where A is the estimate of what m should read based on m, , m .... m.. The 

a D c t 

estimated error E & in what A is reading may be derived by simply: 

E - m - A (2* 6) 

a a 

For the situation where a failure is already known (second "fail search") the 
procedure is identical except the known "bad" measurement is not included; scaling 
may be adjusted accordingly and only five equations used. For processing ease, if 
A were known to have failed, m & would be substituted for A in each of the original 
six equations, Eq. 2.4. Mathematically these same relationships may be obtained 
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by using the best- estimate solution for b in Eq. 2.2. For example, 
of what the instrument measurements should be: 

m = Hb 

aT Ha a A -1 

B = [ m a m b- ’ - m f ] 

A comparison of the actual measurement (m) with the estimated measurement (m) 
yields an estimate of the measurement error for all six instruments (E q ). 

= m - m (2.8) 


the best- estimate 
(2.7) 


where: 


A 



T 



A A 

E, E 

D C 


A 

E d 


A 

E_ 



The estimated error in the measurement of the six axes is given by the same 
equations as those listed in Eq. 2.4, except that they are multiplied by 1/2. 


The measurement error variance (TSE^) of the six instruments is: 


TSE = E T E o - E a 2 + E b 2 + E c 2 + e/ + E g 2 + E f 2 


(2*9) 


If no instrument errors exist, both equations reduce to zero. If an instrument 
failure occurs, the error propagates through Eqs. 2.8 and 2.9. It is dominant in 
the faulty instruments 1 error estimate but is also reflected at reduced magnitude 
in the other instrument error estimates. If one knew which instrument was at fault 
and adapted the processing structure, the correspondixig five- instrument variance 
(TSE .) with the faulty instrument omitted would then equal zero. It can be shown 
that the relationship between TSE . . the faulty instrument error E., and the TSE q 

is: 

TSE. = TSE q - 2<E.) 2 (2.10) 

Thus (from Eq. 2.10), if a failure exists, the failed instrument's squared error 
(E?) corresponds to 50% of the total six-instrument variance (TSE q ). 

If a prior failure has been detected and isolated, a new equation set must be 
used to enable a second failure detection and isolation capability. This set must 
omit the data from the already known bad axis. The new set is obtained by using 
the same equations for E through E f (Eq. 2.8 as detailed in Eq. 2.4) but replacing 

a X 
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the known failed instrument measurement by the calculated estimate for that axis 
using information derived from the remaining five units. For example, if A had 
failed previously, m^ would be replaced by an estimate of A given by the remaining 
five instruments. A (Eq. 2.5) and the error equations become: 


A 

E 

aa 


1 

2 

A A* 

A ~ A = o 

A 

E u 
ab 


1 

2 

jjn^ — \! 0.2 (A + m c + m^ + m g + 

A 

E 

ac 

= 

1 

2 

|m c — *Jo72 (-A + m fe + m^ — m g + m f )J 

A 

E _ 
ad 

= 

1 

2 

|m^ — ^ (“A + m d + m c + m e + m f )j 

A 

E 

ae 

= 

1 

2 

m e — V 0 . 2 (A + m b — m c + — m^) 1 

A 

E p 
af 

= 

1 1 
2 1 

— n/ 0 . 2 (A + m b + m c — m^ - m e )J 


( 2 . 11 ) 


The corresponding measurement error variance is: 


TSE = E T E = E 2 + E 2 +E 2 +E 2 +E 2 
a a a ab ac ad ae af 


( 2 . 12 ) 


The general formulation for the new equation set derived with the previously 

failed instrument (j) not used, corresponds to: 


TSE 


jk 


= TSE. - 2.5 (E„ ) 2 
J jk 


(2.13) 


The is a unity matrix except that the A. k term equals 0. 


jk 


The corresponding variance TSE^ is: 


E = m - m. 
— |k — —3 


where: 


m. = Hb. and b. = (H T X., H)" 1 H T \., m 

If no second failure exists, TSE^ reduces to zero, i.e., no errors. If a second 
failure, 1, occurs, an error propagates in the instrument error estimate Ej k> Eq. 
2. 1 3 and TSE ... The error is dominant in but is also reflected at reduced magnitude 
in the other instrument estimates. If the originally failed instrument, j, and the 
new failed instrument, 1, are deleted from the processing, a corresponding four-in- 
strument variance TSEj k would be computed and would reduce to zero. It can be 
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shown that the relationship between TSE-,, the faulty instrument error E., and TSE 

J K J 1 j 

is: 


*T A 

TSE, = E., E., 

J jk Jk 


(2. 14) 


Thus, from Eq. 2.14, the second failed instrument's squared error E^ 
corresponds to 40% of the 5 instrument variance TSE.. The computer's failure 
isolation algorithm implements these concepts in the following manner. First, all 
six individual errors are computed and Eq. 2.9 is used to calculate TSE . The 
total squared error is compared to an allowable threshold, which may be varied as 
a function of the mission requirement and the dynamic environment. If the system 
is operating within the acceptable TSE^ criteria, no further activity is required 
until the next failure isolation iteration. If the TSE o threshold is exceeded, the 
ratio of each individual instrument error, Eq. 2.4, is squared and taken with respect 
to the TSE If, for example, E_^ is a significant percentage of TSE exceeding a 
selected magnitude, the failure of instrument A is indicated. 


The presence of a second failure is detected when the TSE. threshold is 
exceeded. This failure is isolated by taking the ratio of E? k to TSE . and if E ^ exceeds 
a selected magnitude, the failure is isolated to the 1 instrument. J J 

While the theoretical maximum squared error (E.) 2 for the first failure 
corresponds to 50% of TSE, Eq. 2.10, and (E 2 k ) for the second failure corresponds 
to 40% of TSE j> Eq. 2.14, practical considerations require that an isolation ratio 
threshold be chosen which is lower than these theoretical values. The isolation 
ratio threshold is defined as R q equals E q /TSE for the first failure, and for the 
second failure, equals E^/TSEj. Since the use of quantized data and the acceptable 
noise and residuals associated with the instrument population increase all the E 
terms and the TSE, use of the theoretical values would result in undetected failures. 
The use of too low a value would result in false alarms. 

A plot is shown in Fig. 2. 1.2 A which provides an indication of the safe region 
for quantifying the detection and isolation thresholds. 

This plot shows the largest magnitude ratio, R q for an instrument E which 
has not failed (Curve 1) and the corresponding smallest ratio R q for an instrument 
E j which has failed (Curve 2). These ratios are plotted for a normalized signal to 
noise expression N that is the ratio of the instrument axis accumulated output (signal) 
to the maximum noise magnitude (quantization, uncompensated residuals, etc.) that 
may be expected in that output. Thus N is the ratio of a failure measurement error 
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to the background noise or error residuals of good instruments. In these plots the 
magnitude of the noise is a maximum ( ±1 ) but its signs (+ or -) are considered to 
be equally probable. The curves in the figure result from averaging all of the 
worst-case noise values assuming -f and - to be equally probable. 



Fig. 2. 1. 2A TSE vs Signal-to-Noise Ratio Operating Range-First Fail 

i * 

Viewing Fig. 2. 1. 2 A, note that if the R Q ratio for failure isolation were selected 
below Curve 1, false alarms would routinely occur, (i.e. an unfailed instrument 
could yield a E n /TSE Q greater than the selected R c ). Similarly, if the H Q ratio 
were selected above Curve 2 , missed alarms would occur, i.e. a failed instrument 
could not yield E^/TSE 0 greater than the selected R 0< Thus, to assure reliable 
failure isolation a R c should be selected in the region between the two curves. 
Note that the crossover point of the two curves occurs at 1. 

As expected, in the region to the left of this crossover no decisions can be 
made since the signal and the worst* case noise are equal. As noted previously, 
the FDI cycle is initiated when the TSE threshold is exceeded, providing identification 
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that a failure exists. The discussion on the curves thus far has reflected on those 
regions of R^ selection that yield reliable failure isolation. 

Combined FDI operation is a function of the selection of both of these 
thresholds. The TSE threshold is selected on the basis of the anticipated signal to 
noise (S/N) ratio. The TSE flags the presence of a failure when it is large enough 
to assure that noise can not cause an erroneous isolation decision. For the first 
fail search, the TSE must correspond at a minimum to a S/N ratio of 1. Conservatively, 
since crossover at a higher S/N ratio is possible, a larger S/N criteria should be 
used. For example, if all the outputs have a maximum noise component, the specific 
worst- case sign polarity (probability of 0.03), and an accumulation in which polarity 
occurred at every iteration throughout the FDI period (probability approaching zero), 
the crossover in Fig. 2.1. 2A would move to approximately a S/N of 5.5. Similarly 
the lower Curve 1, would move up and become asymptotic to a ratio of 0.2. In 

practice, to provide adequate detection reliability margin, a TSE threshold criteria 

2 9 

of approximately 2 x 6^0 or 2 x 6A0 error or greater is used. (The factor of 2 is 

2 

derived from Eq. 2.10, where TSE = 2E^ ). In a static environment, with gyro drift 
residuals bounded within 0.10°/ hr, a 6 min accumulator used with the TSE = 2x 6(Aft) 2 
threshold would correspond to approximately 0.1 5°/ hr degradation detection where 
Aft = 5.5 sec. To accomodate for dynamics, an effective Aft of approximately 20 

sec has typically been used. 

The combined first fail FDI uses a TSE criteria that reflects an S/N ratio 
greater than 6 and a failure isolation ratio, R, greater than 0.35. Empirically, 
laboratory testing has demonstrated that a ratio as high as 0.44 provides highly 
sensitive and reliable FDI performance. 

A second set of curves, see Fig. 2.1. 2B, applicable to the second FDI is developed 
using the same approach. Note that the crossover point of the two curves in Fig. 
2 , 1 . 2B also occurs at 1. This second fail search FDI curve also reflects a worst-case 
noise situation and illustrates a somewhat reduced safe selection region (area 
between Curve 1 and 2) since the lower Curve 1 is asymptotic to 0.15 vs 0.1 on 
Fig. 2.1. 2A. Similarly the true fail ratio asymptote (Curve 2) has reduced from 
0.5 to 0.4. For the absolute worst- case condition (the sign of all noise terms having 
a specific polarity distribution) , the crossover for this second fail case moves to a 
S/N ratio of approximately 9 and the Curve 1 asymptote is 0,3. These factors 
illustrate that second fail detection and isolation threshold selection does not have 
as much margin as the first fail FDI. This finding is intuitively obvious since 
there are fewer comparative measurements. Conversely, if one wishes the same 
second fail FDI reliability, some degradation in fault isolation resolution capability 
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TSE Ratio 


will occur. For example, FDX reliability equivalent to the previously discussed 
illustration of a 0.1°/hr fail degradation isolation would correspond to a0.15°/hr 
(TSE^ = 2x 940“ capability in the second fail search. 



Ratio of Signal Noise 

Fig. 2. 1. 2B TSE vs Signal-to-Noise Ratio Operating Range-Second Fail 


In testing, a second fail isolation ratio of 0.38 has been used with good resolution 
and high reliability. A 20 sec effective Ae has been used in the TSE., criterion to 

JK 

allow for dynamic environment noise. Detailed analyses that provide definitive 
assessmentof the FDI reliability are presented in the SIRCJ Utilization Report, R-747. 

Redundancy Management 

The software redundancy management system implements the FDI concepts 
and equations discussed above in the following manner. Prior to each attitude and 
velocity algorithm iteration, the failure detection and isolation algorithms operate 
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on measurements accumulated at the system iteration rate (100 iterations/ sec and 
50 iterations /sec have been mechanized in the SIRU software). Thus the FBI 
algorithms operate to detect and isolate a failure prior to each system iteration. 
If a failure is detected, the least- squares matrix processing, Eq. 2.2, is modified 
to reflect the failure and only the current good data is processed through to the 
attitude and velocity algorithms. Thus, no known bad dataisused. The FDI algorithm 
uses individual accumulators for each instruments measurement data. The accumu- 
lators are incremented at each iteration by the new data sample. Thus, at each 
iteration, the accumulator represents the sum of past and new data. The extent of 
storage, i.e., past data accumulation, is selected on the basis of the desired FDI 
resolution (e.g., for the gyros, an equivalent drift). Periodically, all the accumulators 
are simultaneously purged of an equal time interval of their oldest data. The finest 
detection and isolation resolution is therefore obtained at the FDI test just prior to 
a purging (the maximum interval storage capability). The minimum resolution is 
obtained at the FDI test of the accumulator data remaining just after a purging. In 
test demonstrations a six minute accumulator, purged of old data every two minutes, 
has been used. These time parameters are selectable based on the desired resolution. 
The tradeoff considerations are discussed later in this report. 

After a first failure is detected and isolated, a search is made for a second 
failure. The data used in this search does not include the measurement data in the 
accumulator corresponding to the axis that was identified as failed in the prior 
first fail search. However, the prior failure is continuously examined (its accumulator 
continues to be incremented) by returning to the original first fail search equation. 
This operation allows recertification (use again in forward processing) should the 
failure heal (e.g. the failure may have been due to a transient condition). Thus the 
first fail search is continuously repeated. Similar provision is made for recertifying 
a second failure. After a second failure has been isolated, the appropriate parity 
equation is also examined for a third failure detection. 

The ranking of failures for the purpose of failure management is as follows. 
If there are two failures, that failure which exceeds the isolation threshold ratio, 
computed using data from all six instruments, is ranked first and is considered to 
be the worst failure. The other instrument failure is ranked second. If there is a 
third failure, the second ranked failure and the third failure are included in the 
isolation ratio computation using data from five instruments ( the first ranked failure 
is excluded). The instrument exceeding the isolation threshold ratio is ranked second. 
If it is the same instrument that was previously ranked second, the failure detection 
alarm is continued and the third failure cannot be isolated by software alone,. On 
the other hand, if the third failure exceeds the second fail isolation threshold ratio 
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(in the 5 instrument test), it is ranked second and taken off-line. The previously 
second ranked instrument is now ranked third and remains off-line. In this case a 
third failure has been successfully self-isolated. This capability was successfully 
demonstrated toward the end of the SIRU Utilization program by an example in which 
the third failure was approximately 10 times greater than the original second failure. 


An illustration of the error detection process is shown in Fig. 2.1.3 using 

2 

data from an actual test on the SIRU system. This figure shows a plot of the E^ 

magnitude output (in pulses squared) for all instrument axes as a function of test 

time. The detection TSE threshold used in this test sequence corresponded to 

2 x 1 2 AO pulses where AO was 5. 5 sec (anE, error of 66 sec)- The failure isolation 

ratio used was 0,44. A simulated failure was introduced in the A axis gyro (bias 

miscompensated by 25 meru after 120 seconds of normal system operation). Note 
2 

that the E error magnitude increases until the failure detection threshold is exceeded, 

150 seconds after the failure was introduced. At that point the failure is isolated 

to the A gyro. After isolation, the A gyro data is no longer processed, and the 

error propagation in the estimate of B through F instrument errors is reduced 

, significantly. The resultant system attitude error during this time interval. Fig. 

2.1.4, shows the gyro drift rate error propagating as an attitude error until detection 

and isolation occur. The total error accumulation caused by this A gyro failure is 

less than 15 sec in both the X and Z axes. Note that the failure detection is 

o 

time-dependent since it is based on the magnitude of accumulated pulses, but 
the attitude error is bounded within 28 sec (for the particular magnitude of TSEd 
used in this test demonstration) for an isolated failure regardless of the magnitude 
of the instrument drift rate error. 


It should be noted that the propagation of an error into the system attitude 
output, as shown in Fig, 2.1,4, occurs because the processing of data continues 
until sufficient error develops to enable a failure detection and isolation decision. 
In other words, a finite time is required to accumulate sufficient data to enable a 
FDI decision. During this time (until the TSE criteria is exceeded) the error 
propagates through the least- squares processing to the attitude algorithm. The 
bounded maximum error for the first FDI corresponds to the instrument angle error 
Ej times one half the cosine of the dodecahedron half angle, 0,425 (see Appendix 
A). This reduction in the error propagation magnitude is attributable to the 
least- squares processing, six instruments being weighted geometrically, thereby 
reducing the effect of a single instrument’s measurement error. Generally , this 
attitude error propagation has negligible influence on a mission since the basic 
drift detection resolution must be compatible with acceptable performance over an 
entire mission phase. Thus, if 0.37°/ hr drift uncertainty performance is the limit 
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TIME (s) 


Fig, 2,1,4 Failure Simulation - SIRU 
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for acceptable drift performance during a mission phase, the influence of a 15 sec 
error associated with the FDI of a 0.38°/ hr drift error is negligible. Clearly, the 
relative performance resolution capabilities are therefore the principle interest. 
The resolution, given a . specific TSE criteria, is a function of the system noise, the 
calibration residuals, and the FDI accumulator storage time. The tradeoffs involved 
in the choice of these parameters are discussed in the next section. It should be 
noted, however, that dependent on the computational complex supporting the instru- 
ment hardware configuration, processing schemes can be implemented that would 
not yield a resultant attitude error when a performance degradation failure above 
the FDI thresholds occurs. For example, in a three computer complex all data 
from the six measurement axes could be used in all computers for FDI, but only 
selected sets of four axes of data would be processed in each computer through the 
least- squares matrix. Thus, an attitude error due to the time the failure took to 
be detected and isolated would appear in only those computers that were using in 
its four axes processing the specific instrument that had failed. At least one computer 
for a single failure case would not reflect an attitude or velocity error due to this 
failure and all computers, since they were using all axes in their FDI processing, 
would know which axes had failed. The ref ore, each computer would know the relative 
status of its data. The velocity and attitude status of the affected computers could 
be reinitialized, and the processing equation sets reorganized to assure that a second 
failure could be tolerated in the same manner by at least one unaffected computer. 

FDI Threshold Tradeoff Considerations 


In the present implementation, the gyro failure isolation criteria achieves 
detection and isolation in 35 seconds for a performance deterioration equivalent to 
a 100 meru change in bias. Proportionately longer times are required for detection 
of smaller performance changes. With the current 6 minute accumulator and a 4 
cm/sec pulse weight, accelerometer bias changes equivalent to a 0.1 cm/sec 2 can 
also be detected and isolated. Equivalent detection and isolation is achieved for 
instrument scale factor (SF) and alignment degradation. 

Because of the nature of the nominal uncertainties associated with SF and 
alignment in strapdown error propagation, special FDI considerations are required 
for operation in the laboratory where continuous test revolutions are often imposed. 

Scale factor or alignment degradation corresponds to a change from the 
calibrated AO or AV pulse weight or an angular change in an instrument’s input 
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axis orientations from its previous calibrated orientation. Errors due to these 
types of degradation do not propagate, however, until rotation (for the gyro) or a 
specific force (for the accelerometer) is sensed. Thus, a SF or alignment change 
in combination with, for example, a slew (constant rate) input results in an angle 
error. This angle represents an equivalent drift magnitude during the slew period. 
Of significance in a mission, however, is the attitude error resulting from a SF or 
alignment change and its effect on guidance and navigation. The attitude or velocity 
error for the ternary loops used in SIRU is proportional to the total attitude maneuver 
or velocity change. In a static environment with only earth rate and gravity inputs, 
the error associated with a 1000 ppm SF shift in a single gyro (sensing the major 
portion of earth rate) corresponds to 0.01 5°/ hr drift. This type of error propagation 
is within the calibration uncertainties of drift terms. Representative SF calibration 
uncertainties consistent with current moderate performance technological 
capabilities is on the order of 100 ppm and in the SIRU configuration 20 ppm 
performance has been achieved. For many applications an uncertainty on the order 
of 200-300 ppm at the start of the mission and over the entire maneuver profile 
may prove satisfactory. For example, from the Space Shuttle trajectory once around 
abort studies error coefficients, presented in Appendix A of the SIRU Utilization 
Report, R-747, a 200 ppm gyro SF error in the worst axis would correspond to 
approximately a 4.4 nautical mile cross track error at the 100,000 foot entry altitude. 
Clearly, in a static prelaunch environment large SF deviations can exist, while due 
to the nature of their propagation characteristics in this environment, the cor- 
responding attitude error would be perfectly acceptable. Similarly, since the TSE 
type FDI uses individual axis body frame attitude error estimate accumulations 
over a finite period, relatively large gyro SF and alignment errors would not cause 
the failure threshold levels to be exceeded. For example, with an = 37 sec 

criteria ( 6AA where A Q = 5.5 sec) and a six minute accumulation and, if all the 
earth rate is about the specific gyro, a failure would be identified only if the SF 
has degraded by at least 6,800 ppm (corresponding to approximately 0.1°/hr drift). 
Operation in such an environment with this type of degradation is perfectly acceptable. 
On the other hand, if one were to apply an input to a system rate test of 5°/ sec, a 

SF degradation of only 5.7 ppm could cause the FDI thresholds to be exceeded in 

2 2 

only six minutes. Even if = 132 sec was used in the FDI logic, the failure 

threshold would be exceeded for a SF degradation of only 20 ppm. In both cases SF 
uncertainties of this magnitude are perfectly acceptable while the FDI indications 
would beanuisance. Clearly, the FDI goal is to detect and isolate a SF degradation 
level in SIRU in excess of 100 ppm. Thus to circumvent nuisance problems and 
achieve a detection capability consistent with a realistic SF and alignment degradation 
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FDI goal, an algorithm was implemented that increased the TSE limit on the basis 
of the dynamic input environment. The technique used was to open the threshold on 
the TSE based upon the magnitude of a triad solution body angle accumulation. 
That is, the TSE is increased by an amount proportional to the magnitude of the 0 
Qy> body angle traversed in the same six minute FDI accumulation period. For 
simplicity, however, rather than generating a vector magnitude, the TSE increment 
(A TSE in sec 2 ) was made proportional to the sum of the magnitude of the individual 
triad body axis accumulations, e.g.: the ATSE is synchronized with the FDI 

accumulators and it updates the TSE limits prior to each FDI test. 

The scaler K, during the test program, was set so that the TSE was increased 
by 44 sec for every 1/8 radian accumulated. This scaling is equivalent to opening 
the TSE to allow for a SF degradation of approximately 150 ppm (i.e, if rotation 
was essentially about the degraded axis ) under a constant slew test. The considerations 
applicable to alignment shifts are essentially identical and the scaling corresponds 
to approximately a 30 sec alignment shift detection capability. 

The isolation resolution performance capability of the SIRU system TSE 
technique as a function of the FDI accumulator storage time for different effective 
quantization (AO) levels is illustrated in Fig. 2.1.5. Quantization levels of 44 sec, 
20 sec and 6 sec are shown in the figure. The limiting condition is for 6 resolution 
corresponding approximately to the present SIRU gyro interpolator quantization. 
Note in the figure that when the storage time exceeds 600 seconds, all of the curves 
flatten out and there is little to be gained by longer accumulator storage time. 
During the test program, storage times used varied between 3 and 6 minutes. In 
the six minute accumulation, for convenience, the old data was purged every 2 minutes. 
(One minute purge cycles were implemented with the 3 minute accumulation). The 
six minute accumulation represented the maximum accumulation storage time and 
therefore the highest resolution FDI. The 4 minute value remaining immediately 
after the oldest two minute portion of data had been purged represented the lowest 
resolution FDI for the six minute accumulation. These values (360 and 240 seconds 
respectively) occur at the knee of the 6 sec quantization curve and for this value of 
quantization the accumulator storage times are therefore optimum. The theoretical 
performance isolation resolution corresponding to these storage times is on the 
order of 0.1°/hr, This 0.1°/hr value corresponds to using six times the 5.5 sec 
quantization noise for Ej in the TSE threshold and a 6 minute accumulator storage 
time. 
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TIME ( seconds ) 


Fig. 2.1.5 Isolation Capability vs Accumulator Storage Time 

In the SIRU hardware testing, use of a TSE based on the 6 sec quantization 
has resulted in occasional ”ialse alarms”, he,, failure indication of a specific 
instrument on a transient basis where no failure has actually occurred. This 
phenomenon was traced to the occur ranee of a spurious burst of 2-3 pulses which 
resulted in no net integrated angle but did, in the presence of other residuals, cause 
the TSE to be exceeded during an FD1 accumulation cycle time. Thus, on a transient 
basis, an instrument was taken out of the data processing structure until the 
accumulator purged the transient data hurst and requalified the instrument (approx. 
120-180 sec later). The noise effect, although random and infrequent, was traced 
to the long cable run, (approx 50 T ) and the table slip ring interface between the 
gyro module outputs and the computer. An effective quantization corresponding to 
the AG = 20 sed curve in Fig. 2.1.5 was used initially to allow for this noise phenomena, 

9 

equivalent to operating with a TSE of approximately 2 x 24A9 with AG equal to 5.5 
sec. Subsequent dynamic testing illustrated that an equivalent noise in a two minute 
accumulation period on the order of 18 sec could be induced by 1 Hz, l/2°pr-p 

vs. 9 

oscillations. Therefore the 2 x 132 sec TSE criteria was retained as a nominal 
threshold. The accumulator structure was not optimized to correspond to a more 
sensitive drift resolution (from Fig. 2.1.5 ten minutes would be more optimal) since 
the software was sufficient to demonstrate the FDI mechanization and the new 
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statistical FDI did not require this type of accumulation approach. During static 
tests, however, finer resolution capabilities were demonstrated, e.g., Fig. 2.1.3 
illustrates a 2 x 66 sec^ TSE criteria corresponding to an effective A0 quantization 
of 11 £ec. A 0.1°/ hr FDI with a six minute accumulator was demonstrated in static 
tests when drift.residual uncertainties were bounded within approximately 0.015°/hr. 
Figure 2,1.6 shows the error propagation in attitude (sec) as a function of the TSE 
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detection threshold (in sec) . As discussed previously, an attitude error is propagated 
until the failure is detected and isolated. This curve shows the linear relationship 
of the maximum system attitude error (resulting from the least-squares processing). 
The maximum error reflected in a single triad reference axis corresponds to 0.425 
and 0.62 of the instrument error (E..) that is accumulated prior to exceeding the 
TSF threshold and to isolation of a first and second fail respectively (Appendix A). 
As the effective quantization noise is lowered, the system attitude error propagation 
is also lowered since the detection threshold can be lowered. With 6 sec quantization, 
the attitude error is less than 20 sec. When the effective noise is 20 £ec the system 
attitude error propagation is about 50 sec. A quantization of 44 ^Tec, used prior to 
the incorporation of the torque loop interpolator, results in an error propagation of 
112 sec. The second failure condition reflects a somewhat higher magnitude of 
attitude error propagation since, after the first failure, the least-squares processing 
uses the remaining five axes of data. Thus, when another failure occurs, the smoothing 
effect degrades. As noted previously, if a redundant computer implementation was 
used, simple logical utilization of different sets of measurement axes data in different 
computers for the algorithm processing would assure that at least one computer 
would be identified as retaining a non- degraded system output. 

Table 2, 1, 3 Demonstrated Redundancy Capabilities 
Fault Detection and Isolation 

No False Alarms 

-F ilter 3 Min 6 Min 

Soft Failure: 0, 75°/hr 0. 375°/hr 

(Drift Change) 0.2 cm/sec 2 — 

100 ppm SF as low as 0.0 5 rad/sec input 


Quantization Limit: 


A0 = 6 sec 
AV = 4 cm/sec 


(Random False Alarms on Noise Burst) 

0. 18°/hr 0. 09°/hr 

0.13 cm/sec 2 0.065 cm/sec 2 


Demonstrated Results— Hard or Soft Failure: 

No False Alarms Random False Alarm 

System Attitude Error *-60 sec 16 sec 

Velocity Error ~15 cm/sec 


Table 2.1.3 summarizes the significant performance values for the SIRU TSE 
detection and isolation methods for both gyros and accelerometers. For gyros, the 
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drift and bias levels have been reliably detected and isolated. They correspond to 
the resolution associated with the full six minute accumulator storage time. If 
occasional random false alarms are allowed, the detection and isolation thresholds 
can also be lowered. For accelerometers, the static FDI operation is essentially 
limited by the pulse quantization used. SIRU was scaled for the Apollo mission to 
preserve a 19 g capability, resulting in a AV quantization of 4 cm/sec. Dynamic 
errors introduced when large angular rate inputs are applied are the primary cause 
for random accelerometer false alarms. 

The FDI technique described in this text has been limited to the TS E and 
parity equation approach. In late 1971 concepts for improving FDI resolution by 
specifying the coverage (reliability) and classifying the nature of the performance 
degradation (random or stable bias, etc.) with a subsequent recalibration were 
conceived. These techniques were based on a statistical FDI algorithm. During 
the late 1971-72 period the statistical technique was developed and matured. 
Significant performance resolution improvement with reduced data storage was 
achieved. For example, FDI resolutions equivalent to 1.5 times the populations 
standard deviation was demonstrated. Recalibration with high accuracy was also 
demonstrated. The statistical technique is described in the SIRU Utilization Report, 
R-747. 

2.1.3 General System Software Description 

A general purpose computer (Honeywell DDP-516) is used to verify the 
redundant SIRU system software design by providing an instrument calibration and 
real-time system evaluation capability. The DDP-516 is a 16-bit machine with 
memory cycle time of 0.96 microsecond, a high-speed arithmetic package and 16,384 
words of core memory. Peripherals used include: two disc drives, each capable 

of storing 34 million words; a teletype unit; a CRT character display and a high-speed 
paper tape reader. The DDP-516 has been interfaced with the test table encoder 
as well as the SIRU instrument module outputs and thereby provides a capability 
for real-time system evaluation. 

The basic SIRU software flow is shown in Fig. 2.1.7. A detailed software 
coding listing and description is presented in Volume III of this report. As shown 
in Fig. 2.1.7, the individual gyro and accelerometer outputs (A0s and AVs) are 
compensated to provide corrected body rotation and body velocity. This information 
is subjected to the FDI test prior to each algorithm iteration and failed axes data 
are not utilized by the matrix processor (reorganization). As previously discussed. 
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provision for recertification (reapplication of "healed 11 instruments) is an automatic 
feature of the TSE FDI. Recalibration (recompensation of stable performance 
changes), however, is incorporated as part of the statistical FDI technique and is 
covered in the SIRU Utilization report. The accelerometer and gyro failure status 
is also available for display. The corrected body incremental motion change as 
released for updating is utilized in the matrix processor in which the least-squares 
solution to transform the corrected individual instrument AOs and AVs into a X, Y, 
and Z body frame is performed. The outputs of the matrix processors are used in 
attitude and velocity algorithms to update aquaternion transformation into the inertial 
frame. The transformation is accomplished using a third- order Taylor series which 
achieves high performance at low iteration rates. An analysis of the use of the 
third- order quaternion is presented in both the SPOT Final Report, R-743, and 
Control, Guidance and Navigation for Advanced Manned Missions, Volume IV, Inertial 
Subsystems, P^-600 and is not repeated here. 

As noted, the first step in the processing structure relates to compensation 
of known instrument calibration parameters and dynamic error sources. The gyro 
and accelerometer compensation algorithms accumulate pulses from the torquing 
electronics and corrects them for the various error sources intrinsic to each 
instrument. The result of the compensation yields corrected rotational and velocity 
increments in the body frame. The gyro compensation algorithm corrects for the 
gyro scale factor, the drift components (acceleration sensitive and non- sensitive) 
major compliance, misalignment angles and OA coupling. The accelerometer 
compensation algorithm corrects for scale factor, null bias, misalignment angles 
and centripetal acceleration normalization. Adetailed discussion of the compensation 
techniques is presented in Appendix B. 

Shown in Fig. 2.1.7 are the compensation algorithms and their integration 
with the other algorithms used in the SIRU system. The pulse torque increments 
are accumulated for a period of time determined by the iteration cycle (e.g., 10 ms 
for 100 iterations per second). The gyro and accelerometer iteration cycles are of 
equal length, but are staggered such that the accelerometer-derived velocity data 
is available half way through the gyro cycle (and vice versa). This implementation 
increases the efficiency of data processing and algorithm performance. 

The accumulated input of raw torque pulses is sequentially corrected for each 
parameter by incrementally modifying the count by an amount that is dependent 
upon the magnitude of the error parameter. After all parameters have been 
compensated, two state vectors are derived which represent the body rotation and 
velocity increments in the dodecahedron reference frame. 
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This incremental data is processed by the FDI algorithm to indicate instrument 
failures and by an adaptive matrix processor to transpose the incremental data 
from the dodecahedron frame of reference to a triad frame of reference. Transforma- 
tion from the dodecahedron to the triad reference frame is accomplished with a 
least- squares estimator operating on the six axes of body data. If an instrument 
failure occurs, the matrix processor rejects that instrument's output and accurately 
compiles the triad data from the remaining instruments’ data. Thus, redundant 
performance is exhibited in the triad data. 

The triad data is used to furnish estimates of the environment when required 
to compensate the appropriate parameters (as examples, acceleration sensitive gyro 
drift, misalignment angles and OA coupling). Because the triad data is immune to 
instrument failures, the compensation scheme is also immune to instrument failure. 
Thus the inherent redundancy features are maintained by the use of the triad data 
for compensation. For example, since the A-gyro’s AD1A term (as determined in 
static test) is corrected for g level by using a triad solution derived acceleration 
resolved back into the A-gyro IA axis, the loss of the A-accelerometer does not 
degrade the compensation of the A-gyro. 

The computer memory and percent of machine time required to accomplish the 
data processing described above is summarized inTables 2.1.4A, 2.1.4B, 2.1.4C, 

Table 2.1.4A shows the memory requirement for all of the routines applicable 
to the operating SIRU system, and Table 2.1.4B shows the percentage of computer 
time required at selected iteration rates. The system was initially put into operation 
at an iteration rate of 100 updates/ second and is presently operating at 50 updates/ 
second. 20 updates/ second has been proposed as an acceptable iteration rate for 
several representative applications of the SIRU system. 

Table 2.1.4C shows the memory presently required for servicing and overhead 
routines implemented to aid in the checkout and development of the SIRU system. 
These elements would not exist in a functional installation. 

The basic SIRU memory requirement (4280 words) can be correlated to the 

load map shown in Volume III by adding to it the overhead of 1859 words and the 

blank 243 words of memory between the Digistore output routine and the centripetal 
2 

acceleration, Ru; , compensation to total 6392 words (14370 octal). 

Summary^ descriptions of the SIRU routines are contained in Chapter 4 of Volume 
I and full descriptions, plus load map and listings, are contained in Volume III. 
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Table 2. 1. 4A Basic SIRU Software 


Operation 

Memory Words 

Gyro Compensation 

514 

Accelerometer Compensation 

378 

Gyro Matrix Processor 

124 

Accelerometer Matrix Processor 

86 

Failure Detection and Isolation 
and Matrix Generator 

1706 

Attitude Transformation Algorithm 

278 

Quaternion Unifier 

176 

Velocity Transformation Algorithm 

378 

Base Sector* 

512 

Read Routines 

138 

Total Memory 

4290 


The base sector is used to store static coefficient compensation, misalignment 
compensation, error accumulators, delta theta and delta V registers, quaternion, 
fail status and other often used items. 


Table 2. 1.4B % Machine Time — Basic SIRU 


Update Rate 

% Machine Time 

20/sec 

16. 6 

50/sec 

42 

100/ sec 

83 


Table 2, 1,4 C Laboratory Overhead Software 


Operation 

Memory Words 

Earth Rate Compensation 

70 


Machine Control Executive 

230 


Output Routines 



Magnetic Tape 

101 


CRT Display 

468 

► 1559 

Teletype 

91 


Output Handler 

899 


1859 
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2.2 Electronics 


2.2.1 Redundant Mechanization 


The previous discussions have described SIRU ! s redundant data processing 
and failure isolation concepts. In this section, the manner in which these concepts 
are extended to the electronics is reviewed. Discussion of the electronic design 
features of these circuits is presented in Chapter 3. 

Redundant techniques are employed in the electronic mechanization to provide 
circuit functions that are free from single-point failure mechanisms. Figure 2.2.1 
illustrates the basic features of the mechanization, Functional axes have been defined 



Fig. 2. 2. 1 Block Diagram of SIRU System 

that correspond to each dodecahedron measurement axis. Each axis consists of a 
gyro and an accelerometer module supported by common power supplies. These 
power sources include: a 2 phase 800 Hz gyro wheel power supply; a 9600 Hz supply 
for suspension and signal generator excitation and a dc axis supply. The dc axis 
supply provides the modules' torque electronics with the required logic (5v) and 
amplifier (+10v) voltage levels and a separate floating excitation (15v) for each 
precision voltage reference (PVR). This per- axis implementation enables the 
isolation of any failure to a specific instrument axis or, at most, to a functional 
axis „ The functional axis concept was implemented for ac and floating dc power 
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The timing control pulses for the torque electronics and synchronization 
functions for the various power supplies are redundantly implemented. The oscillators 
are mechanized in a triple- redundant configuration with output frequency comparisons 
by individual failure detectors. 

Dual redundancy is employed in the scaler implementation, and high/low 
frequency detectors test both the 115,2 kpps and 200 pps outputs. The control pulses 
to the torquing electronics are also tested for their presence and proper sequence. 
The selection logic gates only one scaler at a time to the system functional axes 
and power supplies, but both scalers are continuously operated and monitored by 
their detectors. The scaler output lines are separately buffered to assure fail-safe 
operation. In both the scaler and oscillator implementation, provisions for test 
sequencing of all the combinations are included. 

It is important to note that with respect to the dc power supply and the scaler, 
the electronic system configuration was mechanized to provide only fail- s afe isolation 
characteristics because the relative reliability of the particular functional elements 
was used to determine the redundancy level to be implemented. For example, the 
estimated failure rate of a 40v power supply is less than 10 failures per million 
hours whereas a gyro module failure rate estimate might range between 100 and 
200 failures per million hours, determined principally by the inertial instrument 
and the torque electronics. Thus, dual redundancy is sufficient for the dc power 
supply; it does not compromise the end-to-end system reliability index and still 
provides fail-safe operation. Similar considerations were applicable to the dual 
implementation of scalers. Inclusion of a third scaler and dc power supply would 
represent a relatively simple design modification. 

2.2.2 Module Electronics 

Each gyro and accelerometer module includes its own temperature controller, 
preamplifier, torque control loop, etc. Scale factor stability and linearity perform- 
ance on the order of 3 and 20 ppm respectively has been achieved with the present 
instrument control loop within a 1 rad/ sec design range. 

A functional block diagram of the gyro module is shown in Fig. 2.2.2. Note 
that an Interpolator/ Compensator is included in the ternary torque-to-balance loop 
function. 
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supplies because a dual- redundant implementation would have necessitated a complex 
and possibly unreliable system of independent failure detection monitors and switching 
networks. Each gyro and accelerometer module includes its own temperature 
controller, ternary torque-to-balance control loop and other specialized instrument 
electronics. 

The mechanization allows for the incremental AO and AV outputs of each 
instrument module to be stored redundantly in an interface multiplexer. The 
multiplexer would then transmit data and receive control and sampling messages 
from the computer assembly on dual buses. A serial data transmission format 
would be used. The multiplexer included provisions for digitized analog data 
(voltages, etc.) for automatic monitoring to enable more extensive fault localization, 
e.g. to replaceable modules. The multiplexer was designed but not incorporated in 
the SIRU system due to program funding limitations. 

Redundant dc power distribution to the functional axes is achieved by the use 
of dual dc power supplies. These supplies are designed so that each can independently 
support the total load of all functional axes. They are isolated from each other by 
diode networks to provide fail-safe operation. Provisions were made to allow for 
the addition of another dc power axis if further contingency planning was desired, 
i.e., P'ail Operational /Fail Safe. 

Discussion of the design implementation of the dual 40v supply which provides 
power for the gyro torquing current, provides insight into the special design 
considerations that are required to avoid a system failure due to a single-point 
failure mechanism. First and most obvious, the diode interconnection is provided 
on a per- axis basis to assure the availability of 40v power to the gyro modules if 
either of the two supplies fails due to a low output level or to an internal short 
circuit ahead of the diode. Similarly, to protect against a gyro module short circuit, 
fusing is incorporated on a per- axis basis. This feature assures that the 40v 
distribution to all other gyro modules (a solid-state fuse design has been formulated) 
is not influenced by a loading fault. Another more subtle reliability design 
requirement, fail-safe voltage regulation feedback, has been incorporated to insure 
that the 40v input to the gyro module torque loops remains within regulation limits. 
If the 40v were to go above the regulation limit, performance degradation could 
occur on all axes. Therefore, each 40v module has dual- redundant feedback loops 
that regulate and limit its maximum output voltage. The dual feedback loops operate 
to insure that if one loop fails the remaining loop will prevent the module voltage 
from exceeding the regulation limit. Other design features allow 100% continuous 
overload without affecting regulation of the module output. 
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Fig. 2. 2. 2 A Functional Block Diagram of the Gyro Module 

In standard ternary loop operation, the gyro signal generator ( SG ) output is 
sampled and, when the SG signal reaches a given threshold, the control logic applies 
a torque current pulse to the gyro torque generator to return the gyro float to its 
null position. Timing pulses to the logic control the current pulse width, and 
precision current amplitude control is effected by a current feedback loop that 
operates on the basis of a comparison between the PVR and a current sampling 
resistor. 

The Interpolator /Compensator provides a dual function. As a compensator 
it substantially eliminates the effect of the dynamic characteristics of the gyro float 
and linearizes the gyro torque loop output response to the applied input rates. 
Without this compensation, lagging gyro float response to a torque pulse can result 
in multiple pulsing. In the uncompensated ternary pulse torque- to-balance control 
loop at an interrogation rate of 4800 pps and with a float inertia to output axis 
damping ratio (I/O of 330 microseconds, multiple pulsing does occur. In the 
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accelerometer loop, with the 16 PIP Mod B i/C ratio so much smaller than for the 
gyro, compensation for float dynamics was not considered necessary. As an 
interpolator, at each interrogation period the unit samples and holds the analog, 
compensated SG signal, performs an A/ D conversion, shifts in parallel the digital 
data pulses into a serial register and finally sends them to the computer accompanied 
by an end- of "data pulse. The digital data is quantized such that each pulse is equivalent 
to approximately 5. 5 arc seconds or 1 / 8 of the 44 arc second torque pulse. Explanation 
of the operation of the Interpolator/Compensator is provided in further detail in 
Chapter 3. 

The torquer compensation module includes RC networks that tune the torquer 
so that it is a resistive load for the current switch and provides a trim resistor 
for the "dummy" TG load. In the ternary torque loop w r hen torque is not required, 
the current is applied to a "dummy" load which is also a heater (equal in resistance 
to the torquer) located on the gyro TG alignment end mount. The purpose of this 
module is to minimize transients in the current control loop. The switching of the 
current to the "dummy" load minimizes these transients in two ways. When no 
torque is required to be applied to the gyro the same current level is fed through 
the "dummy 11 ; thus the dc amplifier sees essentially a constant voltage, regardless 
of the torquing state. In addition using this "dummy" as a heater on the TG end 
mount tends to maintain a relatively constant thermal input to the gyro, reducing 
loop transients and thermal gradients as well. The 8v power supply is also located 
within the module to minimize lead capacitance which affects switching time in the 
current switch. 

A dc temperature control loop is used in the gyro and accelerometer module. 
It is novel in that the control power includes the output transistor's dissipation. 
The applied power, therefore, is a linear function of control current and a more 
efficient power mechanization results. This efficiency is achieved by mounting the 
output power transistor on the instrument alignment mounts (where the heater is 
also located) permitting the transistor dissipation power to serve also as control 
power. 

The accelerometer module electronic configuration is similar to the gyro 
module, except that the Interpolator/ Compensator function is not incorporated. The 
SIRU torque loop scaling characteristics are listed in Table 2.2.1, The features of 
the electronics design are described in further detail in Chapter 3. 
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Table 2.2. 1 SIHU Instrument Torque Loop Characteristics 


A) Gyro Torque Loop 
Type: 

Dynamic Range: 

Torque Loop Quantization: 
Interpolator Quantization: 
Torquer Power: 

B) Accelerometer Torque Loop 
Type: 

Dynamic Range: 

Torque Loop Quantization: 
Torquer Power: 


Linearized Ternary 
Pulse Torque -to -Balance 
1 rad /sec 
44 sec/pulse 
5 sec /pulse 
2.94 watts — 1 rad/sec 


Ternary Pulse 
Torque -to- Balance 
19 g 

4 cm/sec per pulse 
0. 78 watt— 19. 5 g 
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PRECEDING PAGE BLANK NOT FILMED 

3.0 System Hardware 

3.1 Electronics Assembly and 
Redundant Instrument Package 

The configuration that has been developed for the SIRU system embodies its 
reliability features in a modular implementation for improved maintainability. The 
system is configured as two separate assemblies; the Redundant Instrument Package 
(RIP) and the Electronics Assembly (EA), 


The RIP consists of a mounting and alignment structure, commonly referred 
to as the 77 -frame, upon which the six gyro and six accelerometer modules mount. 
The assembled instrument package is shown in Fig. 3.1.1, 

Each module consists of a prealigned gyro or accelerometer that is normalized 
and packaged with its calibrated electronics in a sealed unit. The instrument’s 
input axis (IA) is offset at an angle, <2 (31,7°), with respect to its module base. 
"Ihus, when the modules are mated to the Tr-frame’s precision mounting surfaces, 
which lie in orthogonal planes, the instrument’s IAs are aligned to the desired 
dodecahedron symmetry. This mounting configuration allows all units to be prealigned 
in exactly the same manner, and all modules of each type are replaceable and 
interchangeable. Offsets from module instrument alignment to system alignment 
measurements after mounting on the ir-frame have averaged less than 10 £ec. 
Maintenance is further enhanced by the tt- frame configuration that allows direct 
access to every instrument from the front of the package. 

One interesting aspect of this mechanical configuration is that all instrument 
output axes (OAs) are colinear with the reference orthogonal triad. This circumstance 
permits compensation for errors introduced by dynamic inputs about the OA using 
calculations developed from the triad solutions without additional geometric 
resolution. 

The accelerometer module has been designed about the MIT developed size 
16 Permanent Magnet (PM) Pulsed Integrating Pendulum (PIP), a single degree-of~ 
freedom specific-force receiver operated in a torque-to-balance mode. It is primarily 
distinguished from its predecessor, the Apollo PIP, by a permanent magnet torquer 
and a solid float. 

The gyro module has been designed about the size 18 Inertial Reference 
Integrating Gyroscope (18 IRIG) Mod B, a single degree-of-freedom gyroscope 
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SI RU INSTRUMENT PACKAGE 


GYRO MODULE 


ACCELEROMETER MODULE 


7T FRAME 


Fig. 3. 1. 1 SIRU Instrument Package 


developed by MIT/DL specifically for strapdown application. Its PM torquer is 
scaled for torque-to-balance operation with input rates up to one rad/sec, and the 
OA suspension capability is sized to limit radial side loading at this rate to a negligible 
value. It contains a gas bearing wheel package, with a greater than 5 rad/sec slew 
and a multiple stop-start capability. A final report covering the design and 
development of this instrument has been published as MIT Draper Laboratory Report 
R-664 dated June 1970. 

The packaging system developed by the U.S. Naval Avionics Facility, 
Indianapolis (NAFI) was used in the design of the EA as shown in Fig. 3.1.2. This 
approach was selected because, among other features, it permitted the definition of 
the 7r-frame structural design independently of the status of the electronic module 
designs and packaging. The EA design was configured so that functional redundant 
elements are completely separate mechanically and electrically. Thus, an oscillator 
module or portions of a scaler, etc., may be removed without disabling the system. 



S1RU ELECTRONICS ASSEMBLY 


DC power supplies 


clock & scalers 


coaxial data 
connectors 


multiplexer 


inertial component 
test point. & input 
power connectors 


Fig. 3.1.2 SI RU Electronics Assembly. 
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3,1,1 Weight, Volume, and Power 


The weight, volume and power requirements of the RIP and the EA are shown 
in Table 3.1.1. Project funding did not permit the development of microminiature 
electronics and the interface requirements limited possible size reductions. A 
production design without these restrictions would result in significant weight, volume 
and power reductions. A further breakdown of the components of the RIP is shown 
in Table 3.1.2. 


Table 3. 1.1 SIRU Weight, 

Power, 

and Volume 


Assembly 

Weight 

(lb) 

Volume 

(in 3 ) 

Power 

(watts) 

Redundant Instrument Package (RIP) 

62. 94 

1753,84 

182.4 

Electronics Assembly (EA) 

33.50 

1155.00 

124.0 

RIP— EA Harness 

6.25 

— 


Totals 

102. 7 

2908. 84 

306. 4 


Table 3.1.2 Redundant Instrument Package 


Assembly 

Qty 

Dimensions 

(in) 

Weight 

(lb) 

Power 

(watts) 

Gyro Module 
Accelerometer Module 
77 -Frame 

6 

6 

1 

5 1/4x4 3/8x4 
4 1/4x3 7/8x3 9/16 
20 1/ 4x15 1/16x5 3/4 

4. 35 
2. 64 
21. 00 

23. 0 
7. 4 


The SIRU configuration satisfies manned spacecraft design considerations 
(vacuum, thermal by conduction, etc.) and can be compared with the Apollo Inertial 
Subsystem (ISS) which has similar packaging density. The total Apollo equivalent 
ISS weight, volume and power is 93 lbs, 2654 in^ and 216 watts, respectively. To 
achieve the same relative reliability as SIRU, such as would be required for the 
space shuttle, three to four such systems would be required. 

As a development model constrained by the time line, fiscal and interface 
factors specified in the authorizing contract, the present RIP does not represent an 
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ultimate design miniaturization, although it is a realizable competitive equipment 
configuration (the use of hybrid medium scale integrated electronic packaging 
techniques, for example, could reduce the system weight by over 50%). It serves 
to demonstrate the redundancy, the failure detection and isolation capability and 
the performance level to be expected from this type of equipment using a high 
reliability, low risk packaging technique. 

3*2 Redundant Instrument Package 

3,2,1 Inertial Component Mounting Concept 

The formulation of a mounting concept for the inertial components (ICs) in 

the SIRU system was finalized after examination of all design objectives and 

constraints. The basic considerations were mounting frame complexity, instrument 

environmental sensitivities, module normalization requirements and 

interchangeability goals. Each of these basic considerations included supplementary 

elements that had to be considered with respect to each other without violating the 

objectives of in-flight maintainability and of form factor compatibility with the Apollo 

* 

Command Module Lower Equipment Bay. 

Figure 3.2,1 shows one possible conceptual approach. This mechanization 
aligns the gyros such that all spin axes (SAs) are normal to the Z axis. The resulting 
advantage lies in the elimination of one of the g- sensitive drift terms during thrusting 
along the Z axis . The major drawback to this configuration is the degree of complexity 
required in the mounting frame. Figure 3.2.2 presents the concept that was 
implemented. The simple box shaped schematic reflects the ability to position the 
instruments in three orthogonal planes while maintaining each instrument's IA aligned 
normal to the face of a regular dodecahedron. 

Using the n box M approach, several choices were available for the arrangement 
which provides the dodecahedron angle. Figure 3.2.3 illustrates two methods. In 
the first, the IA is aligned normal to its mounting base and the angle is machined 
into the mounting structure. In the second, which was the method selected, the 
dodecahedron angle is achieved at the module level. Figure 3.2.4 shows the IA 


The contract required mechanical and electrical interface compatibility with the 
Apollo GN&C equipment (see Chapter 1, Introduction). 






IA Aligned XBase No Alignment Aligned on Fixture with SI RU Angle 

Pins Required. Alignment Pins Required. 

ALTERNATIVE DESIGN IMPLEMENTED DESIGN 

(a) <b> 

Fig. 3.2.3 Possible I/C to ir-Frame Interfaces 



Fig. 3. 2. 4 Accelerometer Module Mounting & Alignment 
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alignment of the accelerometers and Fig. 3.2,5 illustrates the fixturing and test 
method utilized to achieve the proper IA alignment for the gyros. The arrangement 
finally chosen represented a modification of the "box 1f approach which placed all 
the instrument modules on the front face with the coldplate heat exchanger mounting 
from the rear. The resulting structure is referred to as the tf-frame. 



The selection of this configuration resulted in the simplest design of the 
mounting structure with no sacrifice in interchangeability and performance. 
Experience has shown that replacement of a module in the system can be accomplished 
in less than ten minutes with a minimum possibility of damage and with an alignment 
repeatability better than 20 sec. 
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3.2.2 Mechanical Design of SIRU Redundant Instrument 
Package 

The SIRU RIP assembly layout is shown in Fig* 3.2.6 with its wiring harness 
removed. This assembly consists of a ^-frame, six gyro modules, six accelerometer 
modules, and a coldplate with overall dimensions of 19-7/8 inches by 15-1/16 inches 
by 5-3/4 inches and a weight of 70 lbs. with its harness* 



The design objectives shown in Table 3.2,1 determined the RIP configuration* 
It was originally intended to be mounted within the Apollo Command Module Lower 
Equipment Bay with the coldplate connected to the spacecraft coolant lines. The 
RIP was to be removable without breaking these coolant lines. The frame was 
made as symmetrical as possible to obtain the structural rigidity and mounting 
stability necessary to maintain the alignment accuracies required for a strapdown 
system in a flight environment. This symmetry also contributed to good thermal 
design, providing minimum thermal gradients from component to component. A 
three-ball kinematic mounting arrangement was used to mount the RIP to the 
navigation base or to the test base. The parts used in this mounting arrangement 
are identical to the Apollo Optics Assembly mounting hardware. The ICs were 
prealigned and modularized for interchangeability. The frame design was constrained 
to be as simple as possible for ease of fabrication. Structural dimensioning and 
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design tolerances necessary to meet the mechanical requirements shown in Table 
3.2.2 were implemented. Figure 3.2.7 shows the ff-frame consisting of a 6061 
aluminum dip-brazed structure with inserts for mounting the instrument modules. 
The ICs are mounted on four mutually perpendicular planes (the Y axis plane is 
split in two to keep the design compact and symmetrical). An optical cube mounted 
on the under side of the Z axis plane is visible through a hole in the plane and from 
the X and Y directions. A flat mirror is also mounted on each of the IC mounting 
planes. These mirrors were used for alignment and positioning checks during tests. 
Different insert materials are used for mounting the gyros than are used for the 
accelerometers because of the difference in power dissipations; the gyro pads require 
a larger thermal resistance because of higher dissipation. Both materials had to 
behardenable and suitable for lapping to meet the tolerance requirements. Carpenter 
455 stainless steel for the accelerometers and beryllium copper #25 for the gyros 
are the materials employed. 

Table 3. 2. 1 SIRU Design Objectives 

1. STRUCTURAL RIGIDITY AND STABILITY 

2 . THERMAL BALANCE AND GRADIENTS 

3. PREALIGNED AND INTERCHANGEABLE l/C MODULES 

4. FIT APOLLO LEB WITH S/C HEAT EXCHANGER 

5. TOLERANCED TO MEET DESIGN OBJECTIVE ACCURACIES 

6. PRODUCT BILITY 

Table 3.2.2. Mechanical Design Requirements. 


RIP AXES TO OPTICS LOS 20 secs 

PI FRAME TO NAV BASE 5 secs 

PADS AND PINS, X TO Y TO Z TO OPTICAL CUBE 5 secs 

THERMAL GRADIENTS 5 secs 

STRUCTURAL LOADING AND STABILITY 10 secs 
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Mirror 



Figure 3.2,8 shows a cross section through an IC mounting pad including the 
tungsten carbide alignment pins which maintain alignment about the axis perpendicular 
to the mounting plane. Typical tolerances required to meet the mechanical design 
requirements of Table 3.2,2 are: flatness — 50 microinches; perpendicularity and 
parallelism —100 microinches; and finish — 4 to 8 microinches. 

System tests were performed to determine r-frame distortion under extreme 
thermal gradients. 

The testing was accomplished by mounting "dummy 11 thermal gyro and ac- 
celerometer modules on the frame and running the following sequence of tests. 

1. Power to modules on right half of structure 

2. Power to modules on left half of structure 

3. Power to all modules 

4. No power 

The results shown in Table 3,2.3 proved the 77-frameto be relatively insensitive 
to even large thermal gradients. 
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Lapped Flats on Pins 



6061 Aluminum 
Frame 


Table 3.2.3 ff-Frame Thermal Test Results 


GYRO MODULE: 21 WATTS 

ACC MODULE: 7 WATTS 



TEST CONDITION 

MISALIGNMENT 
ARC SEC 

MODULES 

EXCITED 

COOLANT 

FLOW 

X - X 

Y - Y 

1. 

ACCS: A, B, F 
GYROS:C, D, F 

OFF 

-10.2 

+ 7.1 

Ofit 

- 9.7 

- 1.8 

!L 

ACCS: C, D, E 
GYROS: A, B, E 

OFF 

im 

- 11.0 

ON 

■1 

- 3.5 

0 

ACCS: C, D, 
GYROS. C, D 

OFF 

- 5.6 

+ 4.0 

ON 

- 4.7 

+ 14.4 

IV. 

ACCS: ALL 
GYROS: ALL 

ON 

+ 1.4 

- 6.2 

V. 


ON 

! 

+ 1.4 

' + 0.5 
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3.2.3 Modularized Assemblies 


The function of the gyro module is to sense the component of rotation being 
applied along its iA and deliver as its output a sequence of weighted pulses which 
defines the magnitude and sign of the rotation. The action is accomplished by closing 
a ternary loop around the gyro by means of precision current pulses to the gyro 
torquer. The general specification requirements for the gyro module including scale 
factor and drift parameters, input and output power and signal characteristics and 
tolerances, thermal limitations and other system features are provided in Appendix 
C. 


Modularized IC assemblies were incorporated in the SIRU system to meet 
the requirement for in-flight maintenance. The modules are configured mechanically, 
thermally, and electrically to make replacement as simple and straightforward as 
possible. To accomplish a removal it is only necessary to loosen three screws 
conveniently located on the module, disengage a single multi-pole connector and 
lift the module from the 77- frame. Replacement reverses the procedure. This 
capability for simple in-flight replacement depends on the prealigned, normalized 
condition of each module, the accuracy of the remount alignment provision, the rugged 
construction of the assembly, the accuracy and stability of the prealignment operation 
and the self- calibration features of the SIRU. 

The following is a technical description of the gyro module. Substantially the 
same description, accompanied by test results, performance analysis and 
comparisons, including a description of the gyro module test equipment and 
procedures, is presented in Volume II of this report. The accelerometer module 
concept is very similar; a 16 PM PIP Accelerometer (PIPA) is substituted for the 
18 IRIG Mod B gyroscope. The accelerometer is also used in a Navy project and 
the material describing the accelerometer module performance is presented in 
Volume IV (classified CONFIDENTIAL). 

The functional block diagram of the gyro module is shown in Fig. 3,2.9. The 
gyro module consists of the following components: 

1. Gyro - 18 IRIG Mod B 

2. Gyro Pulse Torque Electronics (PTE) 

3. Interpolator/ Compensator 

4. 8 Volt Power Supply 

5. Torquer Tuning Network 

6. Bandpass Preamplifier 

7. Temperature Controller 

8. Normalization Assembly 
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Fig. 3. 2. 9 A Functional Block Diagram of the Gyro Module 












A description of the function and principal features of each component follows. 
Additional information may be found in Volume II. 

1. Gyro - 18 IRIG Mod B 

General Description 

The 18 IRIG Mod B is an advanced design, gas bearing instrument specifically 

designed by the Draper Laboratory for the strapdown application. Fig. 3.2.10 is a 

cutaway view of the 18 IRIG Mod B 420 series gyroscope showing the various 

components. The wheel, made from a fine-grained, hot pressed, alumina ceramic, 

rotates at 24,000 rpm on a spool type gas bearing generating an angular momentum 
2 

of 150,000 gm-cm /sec. The ceramic encapsulated motor stator enhances float 
mass stability, and reduces the possibility of condensed contaminants on the bearing 
surfaces. 



Fig. 3.2. 10 18 IRIG Mod B 



The float, which houses the wheel and stator, is fabricated from a high precision - 
elastic-limit beryllium which combines low density with excellent stability. It is 
surrounded by and floated in a high density, controlled viscosity, chemically inert 
dielectric fluid maintained at a precisely controlled temperature. The fluid isolates 
the float from environmental inputs and provides the damping which is an essential 
characteristic of the single degree- of -freedom (SDF) integrating gyroscope. The 
float inertias and compliances about the SA are matched to those of the IA to minimize 
dynamic errors from these sources. 

The permanent magnet torquer (PMT) is capable of developing 150,000 dyne-cm 
of torque, sufficient to balance an input rate of one rad/ sec. Tapered electromagnetic 
suspensions provide radial and axial stiffness capable of restraining the float at 
the rated input angular velocity. The angular position of the float from its null 
location is measured by a multiple E type signal generator (SG). SG sensitivity 
when excited by an 8v, 9600 Hz source is 20 mv/milliradian. 

The instrument is hermetically sealed within a Mumetal shroud to augment 
magnetic isolation, aid heat transfer control and protect the gyro from unauthorized 
adjustment. Temperature control and monitoring are provided by four nickel wire 
wound sensors controlling heaters which are located on the gyro end mounts. The 
complete instrument measures approximately 2 inches in diameter and 3 7/8 inches 
long. Weight is 1.15 pounds. A summary of the characteristics of the 18lRIGMod 
B gyro is presented in Table 3. 2. 4. 

Pulse Torque-to-Balance Operation 

The gyro in the SIRU system operates in a closed loop where the torques on 
the float are restrained by torques developed by the torque generator (TG). See 
Fig. 3.2.11. 

An angular rate imposed about the IA of the gyro produces a torque about its 
OA and causes the float to rotate from the SG null position. The direction and 
magnitude of the float rotation are detected by the SG, and when the SG output voltage 
reaches a given threshold level, a discriminator provides a positive or negative 
set signal, depending on the polarity of the SG output voltage. These set signals 
are interrogated at a given frequency to switch a current pulse of fixed amplitude 
and duration to the TG winding. In the control loop mechanization, a principle error 
source is inaccuracy in the torque pulse area. For example, a torque pulse of 100 
ma amplitude and 200 microseconds width exhibiting a variation from nominal 
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Table 3. 2. 4 18 IRIG Gyroscope Characteristics 


Single Degree of Freedom Floated Gyroscope 
Weight: 1.15 lbs (523 gms) 

Size : 2 inch (5.08 cm) Diam. 3. 86 inch (9.8 cm) Long 

# Wheel: 

Self acting spool type gas bearing (Aluminum oxide) 

Angular Momentum - 150, 000 gm-cm 2 / sec (24000 RPM) 

Maximum Capabilities -.5 Rad/-sec about IA 
>50 g's 60-400HZ 

Synchronous Motor - 4 pole 2<P 28v 800Hz 
2. 6 watts I <£ running 

Drift Sensitivity - 0.004°/ Hr per Volt 


• TORQUER: 

Permanent Magnet -8 poles, AlnicoV IX, ring poles 
1 Rad / sec at 3 watts 


• COIL HOLDER - 8 coils on Beryllium Oxide holder 

• SF SENSITIVITIES TO FLOAT MOTION: 

Radial- 50ppm for 0.4 x 10'-* inches, 

Equiv. to 1.0 Rad I sec about OA 

Axial - 50ppm for 0. 25 x 10 ^ inches, 

■ Equiv. to lOg accel or 29 F off flotation 

Rotational - 50ppm mill i Rad 
i.e. 3ppm for 

Thermal - lOppm / °F 

• STABLE MAGNET CHARACTERISTICS 

Decay 60ppm per decade 
(magnetized after assembly) 

® LOW DRIFT SENSITIVITY- ForTorque Power Cycling 
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Table 3.2,4 IRIG Gyroscope 


Characteristics (Cont) 


£ Thermal: 

• Flotation Temperature - 132^F 

• Drift Sensitivity - <.03 °/ Hr per °F 

• Storage 20° F - 180° F nominal 

• Miscellaneous 

• Gyro Elastic Restraint <0.1 dyn cm per mr 

• Float & Housing - Beryllium 

• Fluid - Brominated fluorocarbon 

• Magnetic * vacuum shroud 

• Suspension : 

• 8 Pole - Electromagnetic Tapered Suspension 

Prevents radial side-loading <1 Rad/ sec -OA 

Prevents axial loading < 20g 2° F 

Reaction torque sensitivity < 0. 015°/ Hr ■ 1% Excitation 

• Excitation - 8V - 9600Hz 0. 83 watts 

£ Signal Generator : 

• Microsyn - 12 Pote E Type 

• Sensitivity - 4. 4mv/mr (1A) A8M).9mv 

• Noise - pickup 800Hz < 160 microvolts 

modulated * 1.6KHZ <10microV 

• Excitation - 8V * 9600Hz 7 ma 
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INPUT RATE 



Fig. 3. 2. 11 Block Diagram-18 IRIG Closed Loop 


-4 - 10 

of 10 ma in amplitude or 2x10 sec in width will cause an error in scale factor 
of one ppm. 

Gyro and accelerometer module specifications and input / output characteristics 
are provided in Appendix C. The gyro module electrical schematic is Dwg. No. 
2304040 and the corresponding schematic for the accelerometer module is Dwg. 
No. 2640424. 

2. Gyro Pulse Torque Electronics 


The function of the gyro PTE is to receive the output from the gyro SG, evaluate 
the threshold level in the torque control logic and, if ordered, supply current pulses 
to the gyro TG as required to reduce the SG signal below the threshold. The width 
of the current pulse is controlled by timing pulses transmitted by the torque control 
logic and the amplitude of the current pulse is maintained by a feedback loop involving 
the comparison of a precision voltage reference (PVR) and a current sampling 
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resistor. The current pulse is transmitted to the gyro TG through a current switch 
which is set by the torque control logic to provide the appropriate polarity. The 
operation of the PTE is described in detail below. 

The output signal from the gyroscope Is first amplified by a bandpass 
preamplifier, fed into the ac amplifier (xlO) in the PTE and then to a comparator 
or threshold device (essentially a strobed Schmitt trigger). 

As shown in the Timing Diagrams, Figs, 3,2.12 and 3.2,13, and the logic 
diagram. Fig. 3.2,14, the comparator is strobed by the leading edge of the 4800 pps 
interrogate pulse (INT) which coincides with the peak of the 9600 Hz signal at the 
comparator. A phase shift adjustment is made in each module to the SG signal in 
the bandpass amplifier to insure this relationship. If, (referring to Fig, 3,2.14) at 
the instant of strobe (INT), the peak level of the amplified SG voltage exceeds the 
positive threshold level (equivalent to 44 sec input) and is in phase with the INT 
pulse, a positive level detect signal is generated which sets the positive level detect 
flip-flop (+LDFF) to its positive state. The output of the +LDFF then sets the torque 
motor set flip-flop (TMSFF), (Fig, 3.2,15), to its negative state (S2,4=-; S3,5=+). 
The positive output of the TMSFF turns on Q3 and Q5 which sets up the current 
switch for a negative torque current command. 

The output of the +L.DFF is also summed with the reset and INT pulses in the 
positive AO AND gate to generate a A9 pulse upon receipt of the reset pulse. This 
A 6 pulse goes to the computer. 

The output of the +L.DFF also goes to the torque switch AND gate where it is 
summed with the INT and the switch pulses. When the switch pulse occurs, a torque 
switch pulse is generated which sets the torque switch reset flip-flop (TSRFF) to 
its switch state so that its output turns on Q6 and turns off Q7. This sets up the 
current switch to send current to the torquer winding instead of to the "dummy" 
torquer. 

After 195.33 microseconds, the INT pulse (4 microseconds wide) starts, 
followed 2 microseconds later by the reset pulse (0.4 microseconds wide). These 
pulses are summed in the torque reset AND gate which sends a pulse to the TSRFF 
switching it back to its reset state so that Q6 turns off and Q7 switches on, returning 
the current flow to the "dummy" torquer load. 

A similar sequence occurs when the negative threshold level is exceeded except 
that a positive torque current and a negative AS are generated. 
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Fig. 3.2.12 PTE Timing Diagram 
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Fig, 3,2, 13 SIRU Gyro Module— Timing 



Fig, 3, 2. 14 PTE Logic 
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♦ 40 v 



Fig. 3.2.15 PTE "H" Switch. 

The torque delivered to the gyro is a function of the duration and amplitude 
of the torque current pulse. The pulse width and gyro torquer sensitivity define 
the pulse scale factor (SF) quantization (44 sec). The pulse duration is determined 
by the time between the reset and switch pulses and is 13.028 microseconds ± 5 
ppm. A stability of 1 ppm over a period of 24 hours is characteristic of the SIRU 
performance. The amplitude is maintained by the Torque Current Loop. Fig. 3.2.16. 
This control loop compares the voltage drop across a precision (standards quality) 
resistor with the PVR. The difference voltage is amplified by the high gain dc 
amplifier and fed back to Q1 which controls the torque current supply to maintain a 
constant current amplitude. 
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The stability and absolute magnitude of the torque current are, therefore, 
established by the PVR, the current sampling resistor (scale factor) and the high 
gain dc amplifier. For a given PVR and dc amplifier, the absolute magnitude of 
the current is determined by the SF resistor which is selected to match the measured 
gyro SF within 200 ppm. The SIRU loop has demonstrated a long term amplitude 
stability of 10 ppm. 


The mode of operation for the accelerometer loop is intrinsically identical. 
Minor parameter differences result from the relative torquer requirements and 
normalization practices at the instrument level. The general characteristics of 
the accelerometer and its module are shown in Table 3.2.5. 

The timing inputs to the torque control logic are reshaped by means of pulse 
receivers, one for the interrogate and one for the switch pulse train. The calibration 
stability of the module is largely dependent on the rise time characteristics of the 
pulse trains. Low noise performance is achieved using a single diode level "standoff" 
coupled to a fast rise, two stage pulse amplifier. Output AG lines are transmitted 
to the computer through line drivers to compensate for possible variation in 
transmission line length, performance characteristics and pickup. The line drivers 
consist of blocking oscillators designed to provide ground decoupling and a high 
level of cable drive power. 
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Table 3, 2. 5 SIRU Module/PIPA Characteristics 


PIPA Module 

1. Dimensions 

2. Volume 

3. Weight 

4. Power 

PIPA 

1- Pl^sical Description 

a) Length 

b) Diameter 

c) Weight 

2. Configuration 

a) Signal Generator Type 

b) Torque Generator Type 

c) Pendulum Support 

3. Pendulosity 

4. Damping Coefficient 

5. Operating Temperature 

6. Torque Parameters 

a) Mode 

b) Nominal Scale Factor 

c) Interrogation Rate 

d) Maximum Torque 
Rebalance Capability 

7. Power 

a) Signal Generator 

b) Torque Generator 

c) Magnetic Suspension 


4. 3 in. x '3. & ih^x 3. 6 in. 
58. 4 in. 3 
1170 gm 
9 watts 


2. 1 in. 

1.6 in. 

354 gm 

Micro syn 

Permanent Magnet 

Floated and Magnetic Suspension 

1 gm cm 

120.000 dyne^cm/rad/sec 
130°F 

Pulsed— Ternary 
4 cm/sec/pulse 
4800 pps 

19.0 g 

0. 04 watts 
0^ 75 watts 
0. 6 watts 


3. Interpolator/ Compensator 

The Interpolator /Compensator (schematic Dwg. No. 2304154) provides a dual 
function. As a compensator it substantially eliminates the effect of the dynamic 
characteristics of the gyro float and linearizes the gyro torque loop pulse output 
response to the applied input rates. Without this compensation, lagging gyro float 
response to a torque pulse can result in multiple pulsing. In the uncompensated 
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SIRU pulse torque-to-balance control loop at an interrogation rate of 4800 pps and 
with a ratio of float inertia to OA damping of 330 micro seconds, multiple pulses do 
occur. In the accelerometer the ratio is much smaller and compensation for float 
dynamics was not considered necessary. 

The float response to a single torque pulse provides insight into this effect of 
lagged response on closed loop operation. Less than one fifth of the total float 
motion response to a single, fixed magnitude torquing pulse, 195 microseconds in 
duration, occurs in the first sampling period (at the 4800 pps interrogation rate). 
Thus, if the angular rate about the gyro IA is in excess of 15% of the full-on torque 
loop capability, the torque loop will always pulse again because only 15% of the 
commanded return travel has occurred before the next interrogation. Over a total 
indicated angle the pulse bursting results in an instantaneous reading error and the 
base A0 resolution is not realized. A compensation technique to eliminate this 
problem is shown in Fig. 3.2.17. Analog voltages, ±E Comp, are developed by 
generating a 206.3 microsecond pulse from a flip-flop circuit which is set and reset 
by the A9 and interrogate pulses, respectively. This pulse, which is approximately 
the same length as the torque command (195.3 microseconds) is integrated by an 
RC network to generate a voltage of the proper phase and magnitude so that when 
summed with the gyro SG signal, the combined signal compensates for the gyro 
float time constant and eliminates the multiple pulsing. 

COMPENSATED S<3SI£wp,u 



Fig. 3.2.17 Interpolator Block Diagram 
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The effectiveness of this technique is illustrated in Table 3,2.6, This table 
presents the distribution of the pulse torque patterns for the compensated and 
uncompensated loop of a SIRU gyro module when operated at 1/4 of maximum rate 
(.25 rad/sec) and at an interrogation frequency of 4800 pps. The first column 
represents the number of times that a particular mode occurred; the second and 
third columns are the number of ON pulses and OFF pulses for that particular 
mode. 


Table 3. 2, 6 SIRU Gyro Module Moding Patterns at 4800 Hz 
Input Rate: 0, 25 rad /sec 


Number of 
Occurrances 



On 

Off 

Without 



Compensation 



1678 

2 

6 

205 

2 

7 

382 

3 

8 

4095 

3 

9 

With 



Compensation 



1132 

1 

2 

4095 

1 

3 

1937 

1 

— ... i 


The data shows a predominant 3 to 1 ratio of OFF to ON pulses and that the 
uncompensated data has characteristically a burst of 3 ON pulses followed by 9 
OFF pulses compared to 1 ON and 3 OFF for the compensated data. The spread of 
pulse patterns is attributable to noise and variations in table rate. This data illustrates 
that compensating the system has removed the spurious output generated by the 
limit cycle. 

As an interpolator, once each interrogation period, the unit samples and holds 
the analog compensated, SG signal, performs an A/D conversion, parallel shifts 
the digital data pulses into a serial register and finally sends the data, accompanied 
by an end-of-data pulse, to the computer. The data is quantized such that each 
data pulse is approximately 5.5 sec or l/8th of a 44 s'ec A 6 pulse. 

The timing of the datapulses and the end of data pulse are shown in Fig. 3, 2, 18, 
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Interpolator Data Pulses 


Interpolator End of Data 
Pulse 


A) +A0 (+5 Vdc amplitude, 2^sec wide) 

B) -A8 (+5 Vdc amplitude, 2/x sec wide) 

C) Interpolator Data Pulses. 4.5 Vdc, 0 to 31 pulses at 1.5 me rate 

D) Interpolator End of Data Pulse, 4.5 Vdc, Z200 nsec pulse width, 208.33 ^sec 

repetition rate 

Fig, 3. 2* 18 SIRIJ Gyro Module Electrical Interface 
Output Signal Requirements 


4, A Volt Power Supply 

The 8v power supply is a dual dc source with identical floated and isolated 
outputs. One +8v output provides excitation to the polarity determining logic of the 
H switch (see Fig, 3,2.15) and the other +8v output excites the torque-torque reset 
logic of the H switch. 

The 8v power supply was located within the module to minimize line capacitance 
that affects torquing performance. In addition, to further reduce capacitance to 
ground and minimize switching transients, the input transformer in the supply is 
designed for minimum interwinding capacitance. 

The 9600 Hz excitation is used for the 8v power supply because of its availability 
in the module, simplifying the module wiring interface. Because of the good regulation 
of the 9600 Hz supply and the relatively high frequency, the size of the transformer 
and the filter components in the supply can be small. The schematic Dwg, No, is 
2304009. 


72 



5 . 


Torquer Tuning Network 


This section contains two series RC networks which are connected in parallel 
with the gyro TG coil (see Fig. 3.2.19), The networks' function is to tune the coil 
so that minimum SF deviation with rate is achieved. The unit also contains a trim 
resistor which is in series with the "dummy" torquer mounted on the gyro. The 
trim resistor is used to adjust the "dummy" torquer resistance to the actual dc 
resistance of the torquer. This "dummy" torquer is a non-inductive heater whose 
resistance is approximately equal to the actual torquer dc resistance. The heater 
is located on the gyro end mount in the module at the torquer end of the gyro. 
When no torquer current is needed, the "dummy” is energized by the PTE torque-no 
torque logic (Fig. 3.2.15), This transfer provides a constant loacl to the current 
source. It also provides a thermal input to the gyro equivalent to that seen by the 
gyro when torquing is commanded. This action minimizes thermal transients in 
the gyro by delivering constant power to the gyro regardless of the torquing 
requirements. 


GYRO 

TORQUER 

COIL 



Fig, 3,2.19 Gyro Module RC Network 
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6 . Bandpass Preamplifier 


This amplifier provides the necessary gain to raise the level of the gyro SG 
error signal to be compatible with the PTE input circuit. It also provides bandpass 
filtering to minimize the unwanted 800 Hz pickup induced by the gyro wheel 
excitation. An adjustment is provided in the unit to correct the phasing of the SG 
signal so that it matches the timing of the interrogate pulse (see Fig, 3,2.13). The 
schematic Dwg, No. is 2304030. 

7 , Temperature Controller 

The function of this unit is to minimize temperature sensitive gyro drift terms 
by maintaining the gyro temperature constant within ± 0.1°F over a range of ambient 
temperatures, wheel power variations, and other thermal disturbances. The 
controller contains two legs of a dc resistance bridge; the other two legs being 
temperature sensitive resistors located in the gyro. The bridge is balanced at the 
operating temperature (132°F) of the gyro. Any deviation from this temperature 
unbalances the bridge and generates an error voltage. This error is then amplified 
by a low level, high gain, dc, integrated circuit operational amplifier. This amplifier 
contains an integrated circuit temperature control loop which keeps the dc amplifier 
circuit at constant temperature in order to minimize dc drift due to temperature 
variations within the amplifier. This amplifier then drives another amplifier which 
drives power output transistors which, in turn, deliver power to a heater located 
on the gyro (See Fig. 3.2.20). The power transistors are assembled into the gyro 
end mounts so that the power dissipated in the power transistor is transferred to 
the gyro. Since the controller is essentially a series dc proportional regulator, 
the sum of the power dissipated in the transistor and the power dissipated in the 
gyro heaters is linearly proportional to the gyro heater current. This mechanization 
is in contrast to the usual situation where the power transistor dissipation is not 
part of the control heat (not located at the gyro) so that gyro thermal control is 
only by heater power which is proportional to the square of the heater current. 
This linear operation simplifies the dynamic compensation of the control loop and 
provides for maximum thermal efficiency of the controller output circuitry. Dynamic 
loop compensation is achieved by the use of a series of RC networks connected 
between the emitter of the TG end mount power transistor and the input to the high 
gain amplifier. The time constant and gain of the RC network are chosen so as to 
stabilize the control loop which would otherwise be unstable due to the high loop 
gainand thethermal lags between the heater and sensor. The network also optimizes 
the transient response to thermal disturbances. T'he schematic Dwg. No. is 2304058. 
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Fig, 3,2.20 Gyro Temperature Controller Schematic 
8. Normalization Assembly 


All of the components necessary to normalize the various gyro parameters 
are located in this assembly. These parameters are the gyro temperature sensor 
resistance, the SG phase shift, the suspension "Q", the suspension stiffness and the 
SG quadrature. In addition, the two resistors used for suspension current monitoring 
are located in this module. The required values of the components located in this 
module are determined during the appropriate phases of gyro and gyro module 
testing. The schematic drawing number is 2304093. 

The location of the above components in an assembled module is shown in 
Fig. 3.2.21. The module is constructed in sections to simplify assembly, maintenance 
and repair. These subassemblies are shown in Fig. 3.2.22. This figure also shows 
a fully assembled module (lower left) and a covered module (upper center). 
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Fig. 3.2.21 Gyro Module Components 



Fig. 3. 2. 22 Gyro Module Subassemblies 


3 .3 Electronic Assembly 


The EA contains all of the system electronics circuitry not included in the 
gyro and accelerometer modules. The electronic elements can be classified as 
either axis-dedicated elements or general electronic function elements (see Fig. 
2 . 2 . 1 ). 


The axis-dedicated elements consist of one each (six total) axis dc power 
supply, 9600 Hz ac suspension and SG excitation supply, two phase 800 Hz ac gyro 
wheel supply and fuse and diode module. The other electronic functions are 
appropriately redundant; 40v 5v, -20v supplies (2 total) and the scalers (clock 
countdown chains for timing pulses, etc., 2 total) are implemented in a dual redundant 
fashion. The oscillators are triple redundant (3 total). 

All elements except the dual dc power supplies are individual plug-in NAFI 
modules arranged for easy access and convenient identification. IC test point 
connectors, axial data connectors and input power connectors are also accessible 
from the top of the assembly. During laboratory testing an extruded aluminum, 
finned plate, heat exchanger assembly was used for the EA instead of a coldplate, 
(The exchanger is removed for access to the NAFI modules and the connectors). 

3.3.1 Axis-Dedicated Electronic Functions 

Electronic functions that are axis-dedicated are grouped by axis in the EA 
tray. Each function is repeated six times, once for each instrument axis, except 
as noted. As shown in Fig. 3.3.1, these functions are theac power supplies consisting 
of a two-phase 800 Hz wheel supply for each gyro, and a 9600 Hz suspension supply 
for each gyro and each accelerometer, the fuse and diode modules, and the axis 
supporting dc supplies. The failure of any one of these functions affects only the 
axis to which it is dedicated (see Table 3.3,1 for specifications and sources), 

1 ) AC Power Supplies 


The waveform produced by the ac power supplies is a synthesized 
sinewave, formed by first generating a stepped series of outputs (see Figs, 
3.3.2, 3.3.3 and 3,3.4). This stepped output utilizes the transistors in the 
output stage of the supply in a switching mode rather than in a linear mode 
with a corresponding reduction in the power dissipated in the transistor. 
This technique achieves an efficiency greater than 70%. 
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Table 3. 3. 1 Axis Supply Specifications 


800 Hz TWO PHASE Output: 

WHEEL SUPPLY 

Regulation: 

Supply Type: 

9600 HZ POWER Output 19600 Hz P. S. ) 
SUPPLY 

Regulation: 

Harmonic Content: 
Supply Type: 

DC AXIS SUPPLY Outputs: 


Ripple: (Switching Spikes) 
Noise: 


Two Phase 800 Hz stepped sinewave 28 V 
RMS 2.6 W each phase 

5 % 

Sinewave synthesized from square-wave 

9600 Hz, 4 V RMS 1.6 W 
9600 Hz, 8 V RMS 2. 5 W 

1 % 

2% Max. 

Sinewave synthesized from square-waves 

Two 15 ± 0.008 Vdc at 11.0 ma (for PVR 
excitation in one gyro module and one 
PIP module) 

+ 10 ± 0. 8 Vdc at 50 ma 
-10 ±0.8 Vdc at 50 ma 
+5.2 ±0.3 Vdc at 0.7 A 

0,6 Vp-p (15 V) (switching spikes) 

0.5 Vp-p (10 V. -10 V) 

0.4 Vp-p (5.2 V) 

0.003 Vp-p (15 V) 





Fig. 3. 3. 2 800 Hz Gyro Wheel Supply 
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Fig. 3. 3. 3 800 Hz Wheel Supply Waveforms 



Fig. 3. 3. 4 9600 Hz Suspension Supply 










By generating a 5 step waveform, the third and fifth harmonics are 
eliminated. In the 9600 Hz supply, this waveform is passed through an LC 
filter to reduce the harmonic content to less than 2% (see Fig. 3.3,4). In the 
800 Hz supply, the inductive gyro wheel load is tuned by a capacitor in the 
gyro module reducing the harmonic content to less than 20%. While the 9600 
Hz supply contains an active regulator to obtain 1% regulation, the 800 Hz 
supply relies on the regulation of the 28 vdc input which provides a regulation 
of 5%. 


The 9600 Hz supply is redundantly clocked from the scaler at 115.2 kpps 
and synchronously locked by redundant 9. 6 kpps lines from the scaler to hold 
the main 9600 Hz waveform in phase with the interrogate and switch pulse 
trains. 

2) Fuse and Diode Modules 

The purpose of the fuse and diode module is to insure fail-safe operation 
of the gyro Interpolator/Compensator from the dual redundant -20 vdc power 
supplies and the gyro pulse torque electronics from the dual redundant +40 
vdc supplies (see Fig. 3.3,5). It also insures fail-safe isolation of the gyro 
temperature controller from the accelerometer temperature controller 
operating from a common +28 vdc unregulated supply, and fail-safe isolation 
of the gyro Interpolator/ Compensator from the accelerometer pulse torque 
electronics operating from a common +28 vdc regulated source. One fuse 
and diode module is provided for each functional axis. 

Fail-safe operation of the redundant dc supplies is provided by the action 
of the blocking diodes (CR1, CR2, CR3, and CR4) which prevent one supply 
from forcing current in a reverse direction into the other supply in the event 
of a low voltage failure. In case of a high voltage failure, the fuses (FI, F2, 
F3, and F4) protect the loads, while blocking diodes again prevent the other 
supply from reversing the current until the fuse blows and removes the failed 
supply from the circuit. In the event of an overload type failure, the fuses 
protect the individual supplies. 

Fail-safe isolation of the gyro and accelerometer loads operating from 
a common or redundant supply is [provided by ’fuses (F5, F6„ F7, and F8K 
In the event of an overload failure, the blowing of one of these fuses removes 
the circuit it feeds from the supply, permitting continuing operation of the 
other circuit. The diodes are not needed in this circuit since there is no 


81 



failure mechanism which would cause reverse current to flow into the supply. 
They are incorporated, however, into the circuit along with other fuses and 
diodes (not shown) to permit operation from dual +28 vdc supplies (if 
incorporated) in a manner similar to the -20 vdc and +40 vdc supplies. 


20 v DC 
A 


20 v DC 
B 


40 v DC 
A 


40 v DC - 28 v DC Unreg. - 28 v DC reg. 
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Temp. Temp. Interpolator/ Pulse Torque 

Cont. Cont. Compensator Electronics 


Fig. 3.3.5 Fuse and Diode Module 


An advanced, semiconductor, self-resetting fuse was studied for use in 
this module instead of the fusible metal type fuse currently employed, but 
limited funding did not permit its further development and incorporation into 
SIRU. Although there was initial concern that fuse life itself might represent 
a reliability problem, no fusing failures have occurred in almost three years 
of continuous testing, except for two operator-induced failures. 

3) Axis dc Supplies 

See Fig. 3.3.6 and Table 3.3.2 for the schematic and output characteristics 
of the axis dc supplies. 
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Fig. 3. 3. 6 Block Diagram— DC Axis Supply 


Table 3, 3, 2 Measured Parameters-DC Axis Supply 

I. OUTPUT VARIATIONS 


A. 15 Vdc Outputs 

1. Load Regulation - ±3 mv for ±10% Load Variation 

2. Ripple - 0. 1 Vp-p 

3. Line Regulation ±1 mv for ±5% B + Variation 

4. Temperature Coefficient - -100 ppm/C° 

B. +10 and -10 Vdc Outputs 

1. Load Regulation - ±0.1 V for ±10% Load Variation 

2. Ripple - 0.5 Vp-p 

3. Temperature Coefficient - -200 ppm/C° 

C. +5.2 Vdc Output 

1. Load Regulation - ±0.1 V for ±10% Load Variation 

2. Ripple - 0.07 Vp-p 

3. Temperature Coefficient - -300 ppm/C° 

II. EFFICIENCY - >65% 
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The accelerometer and gyro associated with each axis share an axis dc 
supply. The supply provides +10v, -lOv and 5.2v as well as two independent 
15v outputs to provide an independent excitation for the PVR in each module. 
The ±10v supplies excite operational amplifiers in the instrument modules 
while the 5.2v excite the logic elements in these modules. 

3.3.2. General Electronic Functions 

All of the non-axis-dedicated electronic functions are located in the EA; two 
are tri- redundant, the oscillators and the Hi/Lo detectors; and two are dual- 
redundant, the 40/20/5 vdc regulated supplies and the scalers. (It should be noted 
that the regulated 28 vdc supplies, while not considered to be a portion of the SIRU 
system, are required to be dual redundant in order to preserve the fault-tolerant 
character of the system). The EA provides for connection to the redundant 28 vdc 
system input with suitable fusing and steering diodes in the fuse and diode modules 
and in other 28 vdc-dependent functions. 

1 ) Clock Oscillators 


Figure 3.3.7 shows the block diagram of the clock oscillator and scaler as an 
array of coordinated functions. The oscillator is a proprietary design developed 
by Bulova. Essentially it is a 3.6864 mega Hz crystal oscillator stable to 0.5 ppm 
under all the environmental conditions anticipated for the SIRU system. 

The tri-redundancy requirement for the clock results from the following 
considerations. The system calibration is dependent upon the accuracy and stability 
of the clock. Crystal clocks are susceptible to failure by excessive drift; and two 
clocks do not provide a voting capability for failure identification. Therefore, a 
three-clock redundancy is required to achieve the one failure fault tolerance for a 
drift isolation using voting. In addition, Hi/L>o frequency detectors in each oscillator 
circuit are provided to isolate large changes for a second failure detection capability. 

2) Hi/L.o Detector 

The output of each oscillator must be monitored and tested continuously and 
the detector operation must be confirmed to preserve the integrity of the system 
performance. 




Oscillators may fail or appear to fail under four possible conditions: 

1) Frequency too high 

2) Frequency too low or non-existent 

3) Differential frequency increasing 

4) Monitor failure 

The Hi/Lo detectors provide tri-redundant monitoring of the condition of the 
individual oscillator outputs. 

Figure 3.3.8 shows the functional diagram of the Hi/ Fail test circuit. This 
"fail high" mode arises from two possible sources. The first results from an alternate 
design of the oscillator preferred by some manufacturers. In this alternate design 
the crystals are cut to operate at twice the Buiova frequency and circuitry is provided 
to divide down to the required value. The SIRU system is designed to accept this 
alternate design and the Hi/Fail test monitors the possible failure of the flip-flop 
used to halve the crystal frequency. The Buiova oscillators currently used in SIRU 
are not susceptible to this particular failure mode. 
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Fig, 3,3.8 Typical Hi Fail Test 


The other failure mode monitored by the Hi /Fail test is a condition of a 
significantly higher frequency output from the oscillator due to failures of the tuned 
circuit components in the oscillator circuit control loop. As identified in Fig. 3.3.8 
input A is the clock input pulse train. These pulses are used to trigger a monostable, 
retriggerable multivibrator. The output pulse width (B) is determined by the RC 
circuit. The output B is combined with input A in a NON gate. From the waveform 
diagram it can be seen that neither A nor B go to zero at the same time if the 
clock frequency is normal. Thus the inputs to the NON gate are not at zero at the 
same time and the output of the gate is zero. If, however, the clock frequency 
becomes significantly higher 50%) than the multivibrator frequency (as determined 
by the RC network) the inputs will be at zero at the same time and produce an 
output at C at the clock frequency. This output is a Hi/ Fail indication and is transmitted 
to the failure logic. 

The Lo/Fail circuit. Fig, 3,3.9, works in a mariner similar to the Hi/Fail 
circuit. In this case the multivibrator frequency is set at a frequency lower than 
the clock frequency by an RC network. The clock pulses, occurring at a rate faster 
thanthe 9601 frequency, keep the gate triggeredON producing a steady state logical 
M 1 M at the output. If the clock frequency drops below the multivibrator frequency 
the output returns to logical ft 0 M at the end of its pulse width before being triggered 
to logical "l" by the clock. The resulting train of pulses at the clock frequency is 
transmitted to the failure logic. 
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Fig. 3.3.9 Typical Lo Fail Test 

Figure 3.3.10 shows the functional diagram for the differential, lest. This 
"differential" mode applies to excessive drift in the oscillator. As shown in the 
circuit diagram a D flip-flop samples the output of one oscillator while being strobed 
by the squared output of another oscillator (clock B). In other words, clock A sets 
the output to a "l" while clock B resets it to "0". If the two clocks are at the same 
frequency, these two events will occur simultaneously and there will be no change 
in the output. If they are at different frequencies an output will be produced at the 
difference frequency. A hysteresis circuit is also included, the function of which 
is to minimize the noise output of the differential circuit. The difference frequency 
goes to a modified Hi/Fail test circuit with capabilities as previously described. 
The remaining circuits are similarly tested in pairs. Differences between any 
channels exceeding 4 ppm results in "majority vote" logic action to isolate and 
"lockout" the highest difference channel. While the differential circuit could be 
used to detect Hi/Lo failures directly, the reaction time is so relatively slow 
(milliseconds) that the alternate circuits (nanosecond reaction time) are preferred 
for these tests. 
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Fig. 3,3.10 Typical Differential Test 

The Hi/Lo monitors are configured to be self-testing for power and logic 
failures within the module. Failures not associated with frequency tests result in 
automatic channel transfer. Channel transfers may also be commanded externally 
by the ground support equipment (GSE) or the computer. 

In the previous discussion of the Hi /Do detectors, the use of the term rf transfer n 
implies that the oscillator channel being tested is the channel in control. The 
probability of failure on the channel in control is only one in three. Therefore, in 
two cases out of three the failed channel will not induce a transfer and the only 
notice of failure will be to the fail status line to the computer. 

Any failure will always produce the "lockout 11 signal. "Lockout", however, is 
not of a latched or permanent type. A failed channel is still tested and if the failure 
clears, the channel is again ready for use. Transient failures which are self-clearing 
result in only temporary disablement. 
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3) 40/20/5 dc Supplies 


These supplies are provided as dual redundant non-axis-dedicated functions 
located in the EA. Each supply is capable of supporting the entire SIRU system 
demand for 40 vdc, +5 vdc and -20 vdc power. The 40 vdc provides power to the H 
switches of the module PTEs. The -20v provides power for the gyro module 
Interpolator/ Compensator. The 5v power is used for the logic excitations of the 
EA functions such as the scaler, and the logic elements of the 800 and 9600 Hz 
supplies. Table 3.3.3 details the summary specification and Fig. 3.3,11 shows the 
circuit block diagram. A dual feedback circuit in each supply prevents high voltage 
runaway. This protection assures that if a feedback line failed open, the other line 
would hold the supply voltage to prevent an increase to a Hi/Fail limit. An excessively 
high voltage at the gyro module PTE 40 vdc H switch circuits could exceed the 
regulation limits of the PTE dc current control loop causing performance degradation. 
The dual feedback provision prevents this possible failure mode. 

A coupling scheme is provided with the dual supplies so that balanced loading 
of both supplies exists when no failures are present. This balanced loading results 
in better regulation of the 5 vdc logic supply. This improved regulation is due to 
the fact that the +5v logic supply does not have an independent regulator but depends 
on the regulation of the 40v dc supply. The diode coupling arrangement, shown in 
Fig. 3.3.12, connects three axes to supp^ No. 1 through a single diode drop and the 
remaining three axes to supply No. 1 through two series diode drops. Conversely, 
the three axes connected to supply No. 1 through the single diode drop are connected 
to supply No. 2 through two series diode drops, and the remaining three axes are 
connected to supply No. 2 through a single diode drop. This load steering scheme 
applies only to the 40 vdc lines which carry the principle system loads. Each 40 
vdc supply has the capability of supplying double the system load; thus in normal 
balanced operation with both supplies functioning, each is operating at 25% of full 
load capacity. 

4) Scaler 


Scalers are provided as a dual redundant non-axis-dedicated function located 
on the EA. The scaler block diagram is shown in Fig. 3,3.13 and the clock/scaler 
redundancy block diagram is shown in Fig. 3.3.14. The principle functions of the 
scaler circuit consist of the following: 

1 . Generation of necessary synchronizing signals for all electronic functions 

2. Self test of scaler circuits and outputs 

3. Transfer to backup scaler upon failure 
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Fig. 3.3.11 Block Diagram-40/ 5 vdc Supply 
Table 3. 3. 3 Measured Parameters-40/5 vdc Supply 


I. OUTPUT VARIATIONS 

A. 40 Vdc Output 

1. Load Regulation - ±0.05 V for ±10% Load Variation 

2. Ripple - 0.5 Vp-p 

3. Line Regulation - ±0.02 V for ±20% B+ Variation 

4. Temperature Coefficient - +250 ppm/C° 

B. -20 Vdc Output 

1. Load Regulation - ±0.05 V for ±10% Load Variation 

2. Ripple - 0.1 Vp-p 

3. Line Regulation - ±0.01 V for ±20% B+ Variation 

4. Temperature Coefficient - +250 ppm/C° 

C. 5 Vdc Output 

1. Load Regulation - ±0.05 V for ±10% Load Variation 

2. Ripple - 0.3 Vp-p 

3. Line Regulation - ±0.003 V for ±20% B+ Variation 

4. Temperature Coefficient - +500 ppm/C° 

II. EFFICIENCY- >70% 
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Axis A 40 v dc 
Axis C 40 v dc 
Axis E 40 v dc 


Axis B 
Axis D 
Axis F 


3-3.12 Diode Losd Steering Scheme 
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Pig. 3.3.13 Block Diagram-Duplex Scaler 
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The following descriptions are presented for each of the functions identified 
above. 

1. Generation of Signals 

a) Module PTE timing signals — interrogate and switch pulses, 4.8 kpps. 

b) EA suspension and SG 9600 Hz supplies— a 115,2 kpps pulse train and 
a 9.6 kpps synchronizing signal provide clocking for the 9600 Hz 
suspension power supplies. The 9.6 kpps signal synchronizes the 9600 
Hz "zero+ H crossover for suspension lock control. 

c) EA dc axis and 40/ 5v dc power supplies — A 38,4 kpps signal clocks 
and synchronizes all the dc power supplies. 

d) EA 800 Hz wheel supplies — A 9.6 kpps synchronization signal for 
waveform generation and a 200 pps synchronization pulse signal is 
provided for the 800 Hz supplies. 

e) Other timing functions— The 9.6 kppssignal also serves as a clean pulse 
for testing the interrogate and switch pulse train within the scaler. 

The 200 pps signal also is available to the computer as a timing signal. 

All of the output signals are steered from the scaler to the using circuit by 
pulse drivers which are integral parts of the scaler. The pulse driver configuration 
is shown in Fig. 3.3,15. Each signal originates at an SN 5401 gate driving dual 
transformer coupled lines resulting in redundantly bussed signals (signals on either 
Bus A or Bus B). Either scaler may drive these buses since they are diode isolated 
and when connected in parallel will generate logic "OR n . 



Fig. 3. 3. 15 Typical Sync Driver 
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The SN 5401 gate output also drives a switch transistor the collector of which 
feeds serially to enable the succeeding flip-flop in the divide down chain of a 
conventional synchronous counter. This arrangement permits a failure of the SN 
5 401 gate to cause failure of the succeeding scaler sections. This failure is detected 
by a simple end-of-counter failure detection circuit which will be described later. 
No further test circuits are required for this sequence of signals. The synchroni zing 
pulses derived by these techniques are approximately 400 nanoseconds wide. 

2 . Self- Test of Scaler 

Each scaler has a main scaler that divides down to 200 pps. In the main 
scaler, the 38, 4kpps, 9, 6 kpps and 2 00 pps output signals arc derived by conventional 
countdown techniques driven as described above. The lowest frequency, 200 pps, 
is fed to a Hi/Lo retriggerable one shot circuit similar to that described for the 
Hi/Lo monitor. A failure in an internal gate or flip flop of a synchronous scaler 
will result in locking the Enable of a next succeeding state change to either logical 
one (1) or zero (0) For the first state (1) the result will be an increase in the 
lowest frequency equal to 2^ where 1 < N < M and M is the highest number of 
flip-flops sharing one clock frequency. The Hi/Fail test circuit will reveal this 
condition effectively. For the second state (0) the lowest scaler frequency becomes 
zero which is detected in the Lo/Fail circuit previously described. Thus, the operation 
of the main scaler is tested by applying the 200 pps signal to one Hi/ Fail and one 
Lo/Fail circuit. 

The 115.2 kpps signal is derived from a subscaler linked synchronously with 
the main scaler. Self-test is by means of a separate Hi/Lo test section. The 
outputs of these test sections are logically f1 OR n connected to one f, FAIL ff gate for 
the scaler. 

The fault tolerance capabilities and test provisions for the two line drivers 
which pass signals from the scaler to six, separate interrogate and the six separate 
switch pulse line drivers are shown schematically in Fig. 3. 3. 16. The drivers are 
designed to operate four interrogate and switch pulse lines with up to two lines 
"dead" shorted without serious degradation. A failure in any one line (due to a 
transformer or other failure) will fail that axis of the SIRU system. Failure of a 
driver transistor or other component will be detected by the test feedback line and 
cause transfer of control to the back up scaler. The test feedback circuit is shown 
in Fig, 3.3.17. The test feedbacks from both the interrogate and switch driver are 
fed to a sequence detector circuit. If the proper sequence of interrogate leading 
edge, switch pulse #1, interrogate lagging edge, switch pulse #2 and the 9.6 kpps 
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Fig. 3.3*16 Switch or Interrogate Drivers 
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Fig. 3. 3. 17 Interrogate & Switch Sequence Test 
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synchronizing pulse is not present or fails to occur, the 4800 Hz output to a Lo/Fail 
test circuit will become quiescent, actuate an n OR" to the scaler "FAIL 11 gate, and 
transfer control to the "backup 11 scaler. 

3. Transfer to "Backup 11 Scaler 

A simplified form of the scaler transfer circuit is shown in Fig. 3.3.18, The 
circuit is a SR flip-flop shared between scalers. When the system is activated 
initially, if there are FAIL, inputs (no scaler fails) into both 5401s, the choice of 
scalers (output of 5401s) is random and an INHIBIT command is sent to one scaler 
and not to the other. If a FAIL signal appears at the input to the 5401 which is not 
issuing an INHIBIT command, it will change its state to INHIBIT, and cause the 
other 5401 to reverse its state. This action locks out the failed scaler and activates 
the functioning scaler. The 5 vdc power on separately fused lines is cross strapped 
to effect transfer in the event of power failure. External commands or override 
options are also possible. 



Fig. 3. 3. 18 Typical Transfer Circuit 
4. 3.6864 mega Hz Optional Clock Drivers 

Originally intended as clock lines to a dedicated computer, simplex n OR n gate 
outputs are power amplified to drive a redundant "Coax A 11 and "Coax B" bus. The 
design and test provisions are the same as for the drivers previously described. 
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5 . 


Power Requirement Summary 


Table 3.3.4 presents a Power/ Efficiency Summary for the EA. The total load 
identified under the heading "Power Out" includes all channel (wheels, PTE, etc J 
power. The variable power for the temperature controllers is excluded, but under 
normal control conditions a total of 6 watts is required for the gyro temperature 
control power and a total of 3 watts is required for the accelerometer temperature 
control power. 


Table 3.3.4. Power Dissipation in Electronic Assembly . 


Circuit 


Power 

In 

Power 

Out 

Dissipation 
per Circuit 

Total 

Dissipation 

Efficiency 

Modules 

9600 Hz 
Microsyn 


28 volt ~ 9W 
5 volt - 1. 15W 

4.2W 

5. 95 W 

35. 7W 

41% 

4 each 
24 total 

800 Hz 
Wheel 


28 volt ~ 7W 


1.8W 

10. 8W 

75% 

6 each 
36 total 

DC Axis 
Supply 


28 volt - 12. 3W 

5.2W 

4.3W 

25. 8W 

65% 

2 each 
12 total 

40/5 Volt 
Supply 


28 volt ~ 112W 

78. 5W 

33. 5W 

40W 

70% 

1 each 

2 total 

Oscillators 


28 volt ~ 0. 18W 

- 

0.18W 

0.54W 


1 each 
3 total 

Clock 








Scaler #1 
Scaler #2 
Hi/Lo #1 
Hi/Lo #2 
Hi/Lo #3 

5.0 , 
volt 

'#1 5.7W 
#2 3.8W 
#1 0.95W 
#2 0.98W 
.#3 0.75W 

- 

12. 18W 

12. 18W 


21 total 


3 .4 SIRU Thermal Design 
3.4.1 Introduction 

Temperature control of the SIRU system/to reduce the effect of the temperature 
sensitivity of the inertial sensors and some of the electronics modules, was 
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accomplished by separately controlling the temperature of each gyro and ac- 
celerometer module and maintaining the mounting base structure (tt- frame) nearly 
isothermal (coarse control) by means of a liquid-to-air heat exchanger cooling loop. 
The EA is forced-air cooled in laboratory operations; in a spacecraft installation, a 
coldplate would be mounted on the top or bottom of the EA. EA cooling provisions 
assure that the junction temperature of the silicon devices are nominally held well 
below the limits required for reliable operation (Pigs. 3,4.1 and 3,4,2). 


COOLANT 



FROM if FRAME 


Fig, 3. 4. 1 SIHXJ Liquid -to- Air Heat Exchanger Flow Diagram 
3,4,2 System Description 

The SIRU system had to be designed to operate on spacecraft coolant Lines 
and be removable without breaking these coolant lines, as well, as to operate in a 
system test laboratory environment at minimum cost. These conditions required 
several compromises in the thermal design. 

The approach taken was to design the RIP and the EA as flyable equipment 
and the heat exchanger (HX) for the RIP and cooling mechanism for the EA as rotary 
table mounted laboratory apparatus. For operation in the test laboratory in a 75° 
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Fig. 3.4.2 SIRU Forced-Air Cooled Electronics Assembly 



F environment, the liquid cooling HX package. Fig. 3.4.3, was designed to maintain 
the RIP TT-frame at a slight temperature rise above ambient, thus avoiding the need 
for a refrigeration unit on the rotary table. The liquid^to-air HX package is mounted 
on the test table, making liquid slip rings unnecessary. 

Each inertial sensor module has its individual temperature controller, and 
the mounting provisions for each module provide both alignment and thermal path 
control (thermal resistance). Controlling the heat flow by means of high thermal 
resistance minimizes- thermal coupling between the inertial sensor modules and 
reduces the control power requirement. Coarse temperature control of some of 
the inertial sensor, module mounted, electronics circuits is achieved as a by-product 
of the inertial sensor temperature control by means of module thermal resistance 
design. Maximum thermal resistance to ambient as required in a spacecraft 
environment would be achieved by an insulating cover (thermal shroud) for the RIP. 

The mounting pad materials for the gyro and accelerometer modules were 
selected to make the thermal impedances between modules and tf-frame compatible; 
i.e.both gyro and accelerometer modules operate at the same percentageof maximum 
control power of their individual temperature controller circuit. The EA is 
forced-air cooled to meet laboratory test needs. For spacecraft use it could be 
connected to the liquid cooling loop or mounted on a heat-sinked structure, depending 
on the allowable spacecraft temperature range. 

Mechanically the thermal design can be considered as consisting of four 
different control areas, namely: RIP, EA, gyro module and accelerometer module. 

3.4.3 System Thermal Design Concept 

Individual temperature control for each IC is not only consistent with the 
redundant implementation but allows for un symmetrical thermal changes. Examples 
of these un symmetrical changes are position sensitivity, module mounting thermal 
resistance variations, single component wheel power variation and random inputs 
such as torque commands. 

In order to provide maximum isolation of the controlled element, the heaters 
are located at the IC mounting surfaces within the modules. The liquid cooling 
loop to the RIP eoldplate develops a reasonably constant thermal sink. The RIP 
coldplate mounts to the back of the RIP tt- frame in the central well area. Hold 
down screws accessible from the front of the RIP allow attachment of the coldplate 


101 



Fig. 3. 4. 3 SIRU Liquid to Air Heat Exchanger 
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from the front. A gasket spacer between the coldplate and the HIP allows adjustment 
of the thermal resistance between the 77-frame and coldplate. 

Use of a coolant loop provides the capability to regulate the amount of heat 
which is transferred from the 77 -frame to the coldplate (Fig. 3,2.7). Coolant 
temperature and flow rate may be adjusted to hold the 77 -frame at a nearly isothermal 
temperature, suitably lower than the inertial sensor control point. Such adjustment 
of the thermal resistance from the Tt-frame to the heat-sink can be accomplished 
to compensate for environmental conditions or system operating mode. Thus, in 
the standby mode, a high thermal resistance would minimize the power required to 
keep the 77 -frame at temperature. In the operate mode a lower thermal resistance 
would keep the instruments within the allowable controller temperature. This 
regulation capability was not instrumented in the SIRU system for laboratory 
operation. 

# 

The design of the coolant loop for laboratory operation of the system was 
based on operation at 70 ± 5° F ambient temperature to avoid the use of a refrigeration 
unit. Design goals were achieved by reaching a compromise in coolant flow rate 
and coldplate gasket width and material as discussed below. 

A low coolant flow rate reduces 77 -frame to module temperature differences 
(gradients) for the gyro modules (which need more critical temperature control) at 
the expense of higher temperature gradients for the accelerometer modules. To 
maintain the same coldplate transfer, a low flow rate also requires a lower coolant 
inlet temperature. Narrower gasket width results in lower tf-frame temperature 
differences for both type of modules, but also at the expense of lower coolant inlet 
temperature requirements. A gasket made of aluminum has a lower thermal 
resistance than one of titanium, offering the possibility of a higher coolant inlet 
temperature. These variables were optimized in the SIRU system by a small increase 
in the coolant flow rate, utilizing a gasket of 0.5 inch wide aluminum and accepting 
a slight increase in the 77-frame temperature gradients. 

A forced-air cooled tt- frame had been considered, but it required too much 
space and blower power, and temperature control sensitivity was unsatisfactory. 

For spacecraft operation, with a 45° F coolant supply, as specified in Apollo, 
an adaptive regenerative HX could be used for 77 -frame temperature control. The 
lower coolant temperature supply would, otherwise, dictate even higher inertial sensor 
thermal isolation to avoid excessive control power. Optimum thermal performance 
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would be attained by using a regenerative HX and a thermal control by-pass valve 
operating as a function of gyro module temperature control power. The regenerative 
HX would interface with the spacecraft environmental control system with hot and 
cold liquid mixing occurring at the ff-frame coldplate inlet. Other methods for 
controlling the coolant loop in the spacecraft environment are also feasible. 

To attain the fine temperature control needed for both the gyros and ac- 
celerometers, proportional control loops are used. The control circuit is novel in 

that the control power is a linear function of control current. The control power in 

9 

dc control loops typically corresponds to I" R. In the SIRU system linear control 
is achieved by mounting the output power transistors directly on the IC mounting 
block along with the control heaters. The control power then becomes a function of 
both the applied heater power and the power dissipated in the transistor. Since the 
major portion of the controller power is dissipated in the transistor the resulting 
control is both linear and efficient. 

A ternary torque loop is used to drive the inertial instruments. In the zero 
torque mode, the torquing current is directed to a "dummy 11 heater, equal in resistance 
to the torquer, located at the TG end of the instrument. This arrangement results 
in a constant power input to the TG end of the instrument, thereby, reducing thermal 
gradients on the tt- frame. Each gyro or accelerometer module is thermally and 
mechanically interchangeable. 

The use of thermoelectric elements instead of heaters was considered with 
the objective of reducing control power. The concept was not implemented in the 
SIRU development model to avoid the impact of new technology for a non-essential 
purpose. Thermoelectrics should be reconsidered in future designs. Since 
thermoelectrics are bi-polar heat pump devices, the control point can be set at 
zero control power. For a heater system, zero control power means the system, 
has just lost control, 

3.4.4 Thermal Design of the Accelerometer Module 


The thermal design of the accelerometer module was based on a multinodal 
thermal network. Fig. 3,4.4, and thermal model test analysis. The test results 
indicated what changes should be made to the first-cut design. Thermal resistance 
between control heater and mounting block was too high, while the thermal resistance 
between accelerometer and block was too low for good control action and minimal 
temperature variation at the block (see Fig. 3.2.4). One of the effects of these 
combinations was that the temperature variation at the PTE module mounted to the 
side of the block was unacceptable. 
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Fig. 3.4.4 SIRXJ PIP Module Thermal Model Network. 


Recommendations resulting from these tests and incorporated into the final 
design were: 

a) To decrease the control heater-to-block thermal resistance by changing 
the ring material from stainless steel to aluminum 

b) To increase the accelerometer-to-block thermal resistance by increasing 
the clearance between the accelerometer body and block cavity 

c) To increase the block-to-base thermal resistance by the use of Micalex 
washers instead of titanium under the mounting screws 

d) To use an aluminum accelerometer mounting block 

A nodal network representation of the accelerometer module thermal model 
as shown in Fig. 3.4.4 identifies the resistance values in units of °F/watt P The 
numbers indicated by arrows are heat input values in watts. The ambient node can 
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vary from 60 °F to 110°F. Total dissipation is 5.7 watts excluding the control power 
of 2.9 watts* Theresistancevalueof 40.0°F/watt from cover to ambient is a predicted 
value based on the assumption that a thermal jacket having 0.5 inch thick insulation 
will be provided for the RIP in the spacecraft. If this jacket is not present, this 
resistance value could be as low as about 8.0°F/watt. 

The tested prototype accelerometer module can be represented in its simplest 
form by a nodal network of three equivalent resistors* Equivalent resistance for a 
5*6 watt dissipation from control point to frame equals 9° F/watt (including 
1.2°F/watt through greased pads). Equivalent resistance for 2.9 watt maximum 
control power from control point to tf-frame equals 13.0° F/watt. Equivalent 
resistance from control point to ambient equals 12.0° F/watt without n-frame cover 
and 40.0° F/watt with 1/2 inch insulated jr- frame cover. 

Final thermal performance data shows that with bare modules (no insulated 
77-frame cover) in a laboratory ambient of 75°F, the accelerometer modules will 
stay within temperature control range (0-100% control power) over a ir-frame 
temperature range of approximately 92°F to 125°F. In a spacecraft ambient of 60 
F to 110°F, the accelerometer module will maintain temperature control over a 
tf-frame temperature range from 77°F to 103°F if a 1/2 inch insulated 77 -frame 
cover is used (see Fig. 3,4.5). Temperature sensitive electronic modules in the 
accelerometer module, such as the PTE, will experience temperature excursions 
which are approximately 50% of the Ti-frame temperature excursions (see Fig. 3.4.6). 
The detailed description of the accelerometer temperature control circuit is 
presented in Volume IV. 

A separate GSE heater and sensor assembly is mounted on the accelerometer 
alignment block. This heater and temperature sensor are used for GSE temperature 
control of the accelerometer module at 1 25°F, when the SIRU system is in the standby 
mode. A fourth accelerometer body wrap-around sensor is used in conjunction 
with the GSE to monitor accelerometer temperature at all times. Table 3*4.1. is a 
summary of the accelerometer temperature control circuit parameters. 

3.4.5 Thermal Design of the Gyro Module 

The final gyro module thermal design was based on a multi-nodal thermal 
network. Fig* 3.4.7, and model test analysis. 
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CONDITIONS: Coolant Temperature 60° 1C 

Coolant. Plow Rate; 0. 2 to 0. 2 CPM . 
n Frame with Insulated Cover. 

1. 0 Inch Titanium Spacer. 

Fig. 3.4.5 Module Temperature Control Range vs 
7T-Frame and Ambient Temperatures 



Fig. 3.4. 6 PIPA PTE/ 77-Frame Temperature Range 
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Table 3, 4. 1 P1PA Module Temperature Control Parameters 


Voltage: 28 vdc unregulated 

Heater Power: 2. 9 watts max @ 21, 5 vdc 

Power Transistor: 

Control Heater Resistance: 

GSE Heater Resistance: 

Control Sensor Resistance; 

Monitor Sensor Resistance: 

GSE Sensor Resistance: 

Sensors Temp, Coefficient: 

PIPA Nominal Temperature: 

PIPA Temp, Control Accuracy: 


9.40 



2N3752 

159 ohms 
44 ohms 

510 ohms @ 130°F 
498. 5 ohms @ 130°F 
510 ohms @ 130°F 
+0,00226 ohms/ohms/°F 
130 + 1. 6°F 
+0. 1°F 


Fig. 3.4. 7 SIRU Gyro Module Thermal Model Network 
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Results of these thermal test evaluations produced the following conclusions: 

1) A variable- gap thermal interface material of high thermal conductance 
was needed between the gyro alignment plate and the module base plate 
to lower the thermal resistance. 

2) The module could be successfully matched thermally to the ac- 
celerometer module on the 77 -frame by choice of suitable pad material 
in combination with the required thermal interface material (see Fig. 
3.2.7). 

3) The control heater power had to be increased to obtain a wider temperature 
control range. 

The control heater power was increased by interchanging the 80 ohm GSF 
heaters with the 140 ohm control heaters. Thus, power was increased from 6.6 
watts to 10,5 watts. 

Tests were conducted to find a suitable thermal interface material (TIM) for 
module matching. The material chosen was a design by North American Aviation 
used on the Apollo program. This material consists of a copper foil helix wrapped 
around a one-eighth inch diameter silastic tubing. The copper helix provides the 
heat conduction path and the silastic tubing develops the necessary mechanical 
support. Thermal conductance can be var ied to a small degree by the amount of 
compression applied and by maintaining the interface surface either dry or greased 
(see Fig. 3.4.8). The combination of this material and beryllium copper tt- frame 
pad material accomplished the thermal matching. 



Fig. 3,* 4. 8 


Illustration of North American TIM, 
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The nodal network representation of the gyro module thermal model shown in 
Fig. 3.4.7 identifies the resistance values in units of°F/ watt. The numbers indicated 
by arrows are the heat input values in watts. The ambient node can vary from 
60 F to 110 F. Total dissipation is 17,5 watts excluding the control power of 10.5 
watts. The resistance value of 32.0°F/watt from cover to ambient is a predicted 
value based on the assumption that a jacket having 0.5 inch thick insulation covers 
all modules on the n- frame. If this jacket is not present, this resistance value 
could be as low as about 7,0°F/watt. 

The tested protoype gyro module can be represented in its simplest form by 
a nodal network of three equivalent resistors. Equivalent resistance for 17.5 watts 
dissipation (excluding control power) from control point jr-frame is 2.6°F/watt 
(including 0.3°F /watt through greased pads). Equivalent resistance for 10.5 watts 
maximum control power, control point to 77-frame equals 3.4°F/watt. Equivalent 
resistance, control point to ambient is 4°F /watt without tt- frame cover and 20°F/watt 
with 1/2 inch Insulated /r-frame cover. 

Final thermal performance data shows that with bare modules (no insulated 
77 -frame cover) in a laboratory ambient of 75°F, the gyro modules will stay within 
temperature control range (0-100% control power) over a 77-frame temperature range 
of approximately 88°F to 127°F. In a spacecraft ambient of 60°F to 113°F, the 
gyro modules will maintain temperature control over a 77 -frame temperature range 
of 69°F to 97°F, if a 1/2 inch thick insulated 77 -frame cover is used. Temperature 
sensitive electronics modules on the gyro module, such as the PTE, will experience 
temperature excur sions which are 33% of 77 -frame temperature excursions (see Fig. 
3.4.9). 

The detailed description of the gyro temperature control circuit is presented 
in Volume II, Gyro Module, 

3.4,6 Thermal Design of the tt- F rame 

Like the accelerometer and gyro modules, the final thermal design of the 
ff- frame. Fig. 3 .4.4, evolved from preliminary multinodal thermal network analysis 
by a computer program and thermal model tests. The test results indicated the 
following conclusions and recommendations; 

a) A 4 °F temperature variation between mounting pads on the 77- frame could 
be expected at low control power for both gyro and accelerometer 
modules „ 
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b) R ear rangement of modules by moving the gyro modules to colder locations 
and the accelerometer modules to hotter locations would reduce the 
temperature variations occurring in these modules, 

c) Reducing the coldplate contact area to about 1 inch width in the U -shaped 
heat exchanger pattern under the center part of the 7T- frame was necessary 
to minimize tt- frame temperature variations, 

d) Use of a gasket of titanium alloy, with greased interfaces, between the 
coldplate and the 77- frame would provide the necessary thermal adjustment 
to permit use of a colder liquid coolant supply. 

e) Thermal coupling between modules and 77 -frame could be adjusted by 
choice of pad material to provide a thermal match between the gyro 
and accelerometer modules. The pad materials must provide a hard 
surface to avoid wear and scratches which would affect alignment, 

f) No changes in the basic tr-frame structure were required. 

g) For operation in 60°-110°F ambient, as required for flight, the module 
side of the 77 -frame would require a cover with 0.5 inch thick conventional 
foam insulation. 

h) Relocating the coolant inlet to the left side of 77-frame would reduce 
temperature differences at the gyro modules. 

A sketch displaying temperature distribution at each inertial sensor module 
location on the 77-frame is shown in Fig. 3.4.10. The average 77-frame temperature 
varies from 93.0°F to 99.4°F at the module locations. Maximum temperature 
difference at the gyro module locations is 4.8°F, and at accelerometer module 
locations is 5.0°F. These results were obtained with a 74.4°F inlet coolant 
temperature and a flow rate of 0.20 gallons per minute (gpm). 

77 -frame temperature differences for accelerometer and gyro modules as a 
function of coolant flow rate and gasket width are shown in Fig. 3.4.11. The graph 
indicates that coolant flow rate and coldplate titanium gasket width are parameters 
which must be traded off. Reduced flow rate decreases 77 -frame temperature 
differences for the more critical gyro modules, but at the expense of higher 77 -frame 
temperature differences for the accelerometer modules and a lower inlet coolant 
temperature. Reducing the titanium gasket width decreases temperature differences 
for both type modules, but at the expense of a lower inlet coolant temperature. 

For laboratory operations, ambient temperature is controlled at 75±5°F. 
Operation in this environment was achieved without refrigeration, using a liquid-to-air 
HX pumping unit (Fig. 3.4.3), by increasing the flow rate to 0.25 gpm and replacing 
the 1.6 inch titanium gasket material with 0.5 inch aluminum. 
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r ig. 3,4.10 SIRU 77- Frame Temperatures, °F 
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PI PA 
MODULES 


GYRO 

MODULES 




The curves of Fig, 3.4.5 show the 7r-frame temperature range allowable to 
maintain thermal control over an ambient temperature range of 60°F to 110°F. 
Optimized parametric requirements for this figure are coolant temperature of 60°F, 
coolant flow rate of 0.2 to 0.3 gpm, an insulated n - frame cover and a 1.0 inch titanium 
gasket between the coldplate and the 77-frame, Under these conditions, a maximum 
temperature variation of 9°F at the base of the modules on the 7r-frame can be 
expected. This variation is composed of 5°F for 77-frame location, 2°F for mounting 
interface resistance variation and 2°F for liquid coolant supply tempei'ature and 
flow rate changes. The 77- frame and ambient temperature limits are established 
as follows. 


Minimum Temperature Limit 


1. Conditions 

Minimum jr-frame temperature at module 78°F 
Minimum ambient temperature 60°F 


2. Limiting Factor 

Accelerometer module control power full on 


3. Penalty 

If either n -frame or ambient temperature is reduced, the affected 
accelerometer module*s thermal demand will exceed its controller 
capability and the module temperature will drop. 


Maximum Temperature Limit 


1. Conditions 

Maximum 77-frame temperature at module 97°F 
Maximum ambient temperature 110°F 


2. Limiting Factors 

Gyro module control power full off 


3. Penalty 

If either 77- frame or ambient temperature is increased, the affected gyro 
module's thermal demand drops to zero and the module temperature 
will increase. 
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For applications requiring operation over a wider range of ambient 
temperatures, modification of the insulating spacer size and material, 7r-frame 
insulation, and implementation of a regulated coolant loop are required. 

3.4.7 Thermal Design Features of the 
Liquid-To-Air Heat Exchanger 

The SIRU liquid-to-air HX, Fig. 3,4*3, is a closed, pressurized system (5 
psig) that supplies a fixed rate of coolant flow to the 7T-frame in any orientation. It 
is mounted on the rotary table in order to avoid liquid rotary joints. 

The system consists of the following; 

a) a pump for coolant circulation 

b) a manually operated three-way valve for coolant flow direction (coolant 
outlet temperature setting) 

c) a reservoir and expansion bellows (accumulator) 

d) a flow meter for How rate adjustment 

e) a heat- sink consisting of a forced-air to liquid HX 

The flow diagram of the coolant loop is shown in Fig. 3,4.1. The specifications 
for the unit are as follows: 

1) Cooling Capacity: 200 watts at 70°F ambient, 0.46 gpm coolant flow 

and 75°F coolant outlet temperature (HX capacity of 22 watts/°F) 

2) Coolant Flow: Adjustable from 0 to 0.46 gpm 

3) Coolant: Inhibited Ethylene Glycol /Water mixture 

4) Coolant Temperature: Adjustable, 75°F min, in 70°F ambient 

5) Power: 115v, 60 cycles, 1 phase, 0.92 amps 

The HX would not be used in the flight configuration of SIRU. 

3.4.8 Thermal Design Features of the Electronic Assembly 

The EA cooling system was designed for the laboratory environment only. 
Prime considerations were: simplicity of design, minimal effort, no active 

temperature control, avoidance of liquid coolant and easy disassembly. 
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The final design. Fig. 3,4.2, consists of two separately removable, modular 
forced-air HXs mounted over the NAFI modules and a finned, natural convection 
heat- sink under the 40 /5v power supplies. Each of the two identical, forced- air 
HX cools two rows of NAFI modules. Ambient cooling air (13 cfm) is drawn through 
the extruded aluminum finned plate and cover by a muffin fan operating on 115 vac, 
60 cycle power. The HX surfaces are machined and greased for improved thermal 
conductance. 


Since the EA is air cooled from the module side, removal of the NAFI modules 
requires the prior removal of the heat exchanger above that row of modules. The 
40/5v power supplies, on the other hand, can be removed unimpeded from the module 
side. 


At the 70°F room temperature, the maximum NAFI module frame temperature 
is 93°F. Under these conditions the semiconductor junction temperatures inside 
the modules remain below the 105°C reliability limit imposed on high reliability 
equipment in the Apollo program. The power supplies, however, operate slightly 
above (120°C) these established limits. Thermal resistance between NAFI modules 
and the structure is kept low by use of special clips (Bircher), Modules which 
dissipate the most heat are provided with more clips per module. Thermal analysis 
shows that temperature gradients along any row of NAFI modules is less than 2°F. 
Total power dissipated in the EA is 124 watts, 40 watts of which is at the 40 /5v 
power supplies. Table 3.3.4 shows the distribution of power dissipation in the EA. 

3.5 Documentation 

* V • " — ■■ ■ ■■ 1 

The essential documentation of the HIP is contained in Fig. 3.5.1 which provides 
a simplified family tree showing the principal assembly and schematic drawings. 
Table 3.5.1 shows an index of the drawings identified with each of the electronic 
modules incorporated in the SIRU EA. 

A review of the electrical and hardware items currently incorporated in SIRU 
shows thatof approximately 350 items identified in the documentation by commercial 
designation, 250 are already qualified under military specifications or could readily 
be qualified by IDEP, previous military application or authenticated test data. Of 
the remainder, 50 items of miscellaneous hardware require some degree of effort 
to identify completely. It is estimated that one half of these (25 items) will turn 
out to be military specification equivalents. The remainder, approximately 75 items, 
require some degree of qualification action in order to meet a strict requirement 
for qualified parts selection. 
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Table 3*5, 1 Electronic Assembly Documentation Index 


MODULE TITLE . 

ASSEMBLY NO. 

SCHEM. 

DC AXIS SUPPLY 

2304016 

2304005 

DC AXIS SUPPLY DRIVER 

2304011 

2304006 

FUSE & DIODE 

2304039 

2304034 

LOGIC TRANSFER HI/LO MONITOR 

2304051 

2304031 

INTERROGATOR & SW LINE DRIVER 

2304070 

2304066 

EXTERNAL CLOCK DR 

2304074 

2304071 

5 VOC PULSE DR 

2304079 

2304067 

40/5 V DC SUPPLY 

2304086 

2304033 

TIMING & FUSE MOD 

2304091 

2304082 

800 HZ WHEEL SUPPLY PWR AMP SECT II 

2304097 

2304098 

9600 HZ SUSPENSION SUPPLY SECT 11 

2304105 

2304095 

800 HZ' WHEEL SUPPLY PWR AMP SECT l/VI 

2304108 

2304250 

2304251 

9600 HZ SUSPENSION SUPPLY SECT IV 

2304112 

2304096 

9600 HZ SUSPENSION SUPPLY SECT III 

2304114 

2304113 

SCALER 1 

2304236 

2304204 

SCALER 2 

2304237 

2304205 

SCALER 3 

2304238 

2304206 

SCALER 4 

2304239 

2304207 

SCALER 5 

2304240 

2304208 

900 HZ SECT 1 , 800 HZ SECT 1 1 1 

2304241 

2304153 j 

800 HZ SECT IV 

2304242 

2304150 

800 HZ WHEEL SUPPLY PWR SECT V 

2304255 

2304106 

CLOCK OSC ILLATOR 

2304308 

— 
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4.0 Computation Facility and SIRU Software 


The SIRU system was designed with an integral, dedicated computer in mind. 
The computer and its peripheral equipment were sized to support development and 
checkout including test software, and to carry out the full regime SIRU operational 
software. This chapter discusses the computational facility dedicated to the SIRU 
system, the test and operational software and the data handling and analysis programs 
written for this system. 

4.1 SIRU Computation Facility 

A computer facility was assembled to support, initially, the development, 
checkout and testing of the SIRU system including the development of SIRU software 
and software for the originally planned DCA. This same facility later supported 
the operational system. Major components of the facility are listed in Table 4.1.1. 

The general purpose computer is a commercial DDP-516 manufactured by 
Honeywell. It is a 16-bit machine with a memory cycle time of 0.96 microsecond 
and includes the high-speed arithmetic package as well as 16,384 words of core 
memory. The Honeywell DDP-516 is compatible with current state-of-the-art 
airborne flight computers and as such serves as an excellent design demonstration 
and software verification vehicle. The computer has hardware interrupt and its 
structure incorporates direct, indirect and indexed addressing. The DDP-516 is 
relatively fast, its add time is 1.92 microseconds and the high-speed arithmetic 
package features a single precision multiply (5.82 microseconds) and divide (10.5 
microseconds maximum) and double precision add and subtract (2.88 microseconds). 
The computer is compatible with the real-time processing requirements of the SIRU 
system running at a 100 update/ second rate. In addition, the availability of a 
sophisticated disc operating system (DOS) developed for this particular computer 
by NASA/ ERG enables operation with a large, moving head disc storage unit with 
backup capability. This combination of memory and versatile interactive capability 
provided a viable software development facility, 

A detailed description of the computer peripherals listed in Table 4.1.1 as 
part of the Computation Facility is presented as follows. 
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Table 4.1.1 


Major Components of the SIRU Computation Facility 


Equipment Name 

Computer 
Disc Drives 
Teletype 
CRT Display 
Magnetic Tape I/O 
Paper Tape I/O 

Dedicated Data Link to IBM 360/75 
Test Table Interface 


Identification 

Honeywell DDP-516 
CDC 9433 
ASR-35 
Sanders 720 
Digistore Wl-001 
Remex 

Bell 201 A Data Phone 
Wayne George Encoder 


With the availability of DOS, a standard Honeywell disc control unit was added 
to the DDP-516. Two CDC 9433 drives are used, each capable of storing about 34 
million words of data on line. The discs were used for the storage of: operational 
software programs, system calibration and data reduction programs and system 
test data for subsequent processing and error analysis. Programs were developed 
to r ’back-up" a disc by copying it on the second drive. Thus, a file copy of the 
current programs and data was always available. 


User oi iented input/output (I/O) capability is available either through the 
ASR-35 teletype unit or the Sanders 720 CRT. The CRT was procured to facilitate 
software development and for use as a real-time display. In all of the operational 
software described below in Section 4.2 (and in greater detail in Volume HI), provision 
is made for real-time display of the system status. 

Other I/O devices comprise a high speed Remex optical paper tape reader, a 
Digistore magnetic tape deck and a dedicated data phone link to MIT/CSDL f s IBM 
360/75 computer. A paper tape punch is available on the teletype, and all other 
forms of output (card decks, magnetic tapes, disc packs, etc.) are available at the 
IBM 360/75 through the data phone link. Initially, SIRU was dependent upon Digistore 
tape to transfer data to the IBM 360/75 complex, but the data phone link was 
incorporated midway through the program. 

A final interface links the computer to the SIRU system and its test table. 
This interface contains an up-down counter for each inertial component, two 
interrogate pulse counters and a test table rotary axis readout. The up-down counters 
service the AS and AV outputs of the inertial components (IC). The gyro float angle 
interpolators are read separately. 
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An interface was planned for mating the SIRU system with the dual redundant 
Digital Computation Assembly (DCA). However, the DCA and its associated 
multiplexer were not implemented in hardware during this program period. 

Figure 4.1.1 shows the computation facility as set up in the laboratory. Figure 
4.1.2 is a block diagram of the operation, and Figure 4.1.3 shows additional detail 
of a typical AV or A 9 counter channel. 



Fig. 4. 1. 1 SIRU Computation Facility 
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Fig. 4. 1. 2 Computation Facility Block Diagram 
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Fig. 4.1.3 Typical Counter Channel Diagram. 


4.2 SI HU Software Overview 

A regime of modular, interacting programs was developed which functions, 
in general, to calibrate the system, verify its performance, provide failure detection 
and isolation (FDI) and develop navigation functions. 

Using these programs the DDP-516 computation facility is used to perform 
the following specific tasks: 

1- Direct and perform automatically (with the exception of table orientation 
positioning since digital table servo positioning was not available) the 
multiple position calibration test operation on the SIRU system during 
which a complete IC parameter determination is obtained, printed and 
stored. A single position sequence is designed to operate overnight 
and unsupervised. 

2. Direct and perform real-time system testing during which the computer 
implements all the operational software for the following system tests: 

a) Pre-launch calibration sequence 

b) Pre-launch alignment (gyrocompassing) sequence 
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c) IC on-line compensation (static and dynamic) 

d) Redundant six axes body measurements data to least-squares 
computational triad frame and implementation of adaption matrix 
for isolated faults 

e) FDI equation computations to provide Fail Operational, Fail 
Operational, Fail Safe (FO, FO, FS) capability 

f) Implementation of strapdown attitude and velocity algorithms 
supporting the navigation functions 

3. Develop and checkout all of the software requirements for the previously 
described operations including data storage and transfer for subsequent 
analysis using Draper Laboratory 1 s IBM 360/75 computation facility. 


4,3 SIRU Software Description 

The following description of the operational softwareisan abbreviated version 
of the detailed description provided in Volume III* Previous chapters in this volume 
have described the analytical theory and implementation of the software. The 
following material summarizes the software description contained in Volume III, 
All the operational software for the SIRU test system was developed on the DDP-516 
computer facility, while complementary data analysis, data plotting and simulation 
programs were prepared for the IBM 3 60/75. 

This development included the hardware checkout software, the system 
calibration and calculation programs, software development tools e.g., text editor 
and CRT display drivers, and an assembler for the DC A. A DCA self-test program 
was developed using the text editor and the DCA assembler, 

4,3.1 Static Calibration Tests 


SIRU performance is evaluated by comparison of system data with external 
references. The comparison is accomplished through the use of two parallel sets 
of computer programs, the SIRU DDP-516 software and an array of analysis, 
simulation and comparison programs available on MIT/CSDL's IBM 360/75. A 
dedicated link between the two computers facilitates the almost immediate evaluation 
of the SIRU real-time performance. The more important programs for each computer 
are explained in this section. 

The simplest operating mode of the SIRU system is Tr static calibration 11 testing. 
Given the deterministic models of the ICs, it has been shown that a six position 
test (see Table 4.3.1) yields data necessary and sufficient to isolate and compute 
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the static error parameters listed in Table 4.3,2. A DDP-516 program, STLOOP, 
used in each position, serves to collect instrument output in the form of elapsed 
time and torque pulse count for each of the twelve instruments. This data set is 
indexed serially by test position and date, and stored on the disc. In the calibration 
sequence, STLOOP is run in each of the six positions. Fig. 4.3,1 illustrates the 
engineering display. Table 4.3,2 lists the terms and engineering units shown in the 
figure. 

Table 4. 3» 1 Static Testing Equations 

INTRATE • SF J 1 (NCA j -) (1 . + DSF _ i ^ } _ <rad / gec > 

nom i Cjrij 

total drift of the ith gyro in the jth calibrate position (i = A through F, 
j = 1 through 6) 

scale factor deviation from nominal of the ith gyro, where k denotes 
the + or - scale factor (ppm) 

number of timing pulses for the ith gyro in the jth calibrate position 

loop interrogate rate used for timing (4 800 pulses /sec) 

2 ^ + 2 ^ + 2 ^ rad /torque pulse = 0. 213623 mrad /torque pulse 

number of positive (+) or negative (-) AO pulses accumulated for the 
ith gyro in the jth calibrate position 

ADIA = <WA6 - WAS) COSQ GA - (WA1 - WA2) sinQ GA | JE 

2 

ADSA = (WA1-WA2) cosq GA + (WA6 - WAS) sino GA 

2 

ADOA = - WA4 ~ WA3) - + GSA*WIEV 
6 2 

* WAj + 2WIEH (cosa GA + sina GA + GSA*) 

BDA = J-i g 

(WA5^WA6_- WA^_WA2)_ + WIEH , GSA * . cosqGA) 

A2DA 2 * Sin (2a + 2GOA*j 

where 

aGA = a + GOA" 


Wij 

where 

Wij 

DSFik 

TGij 

INTRATE = 
SF 

nom 

NGij 


125 




Fig. 4. 3. 1 CRT Keyboard Display Equipment 
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34.2970 

-0.0124 

-0.0901 

0.00514 

0.00450 

-0.0439 

0.07195 

0.36679 

0.IH00 

0000000 

0000000 

0000000 

0000000 

0000000 

0000000 

0000000 

0000000 

0000000 

0000000 

0000000 

0000000 


17.3055 
40. 6337 
-2 . 9360 
53.9769 
20.5939 
-79720 
-7753.0 
-0.2056 
0.34232 
0000000 

-0. 1532 
23.3594 
-0.2S0S 
0. I20SH 

000000B 

0000000 

0000000 


Table 4. 3.2 Static Error Parameter Display 
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EQUIVALENT INPUT (MERU) 


Two other programs are used to access this data and reduce it to modeled 

parameters (in engineering units). GYRCAL searches the filed data to retrieve the 

$ 

latest STLOOP data set for each of the six positions* extracts the gyro information, 
and calculates the drift parameters, A similar program* PIPCAL reduces 
accelerometer data to extract a^, SF error and two misalignments for each functional 
axis. The results from GYRCAL and PIPCAL are filed on the disc for later use in 
the real-time compensation load, 

STLOOP may be iterated to collect a continual record of system static 
performance in one position. In this case, the 11 minute test is used to collect 50 
to 300 data sets which are identical in form to those discussed above. As before, 
they are filed serially for later analysis. At the command of the test technician, 
the data is transferred to the IBM 360/75. Several versions of a MAC 360 program, 
ICSASTAB , are resident there. These programs process the raw data into engineering 
units, subject it to statistical analysis and produce printed and plotted records of 
the performance stability of the twelve inertial components. This procedure is 
routinely followed and a substantial body of data is available to confirm system 
performance levels. Figure 4.3.2, for instance, graphically displays the stability 
of one gyro over a weekend run. The mean output represents a component of earth 
rate plus the gyro drift; the standard deviation of the data indicates the corresponding 
performance. 



The user may, alternatively, specify earlier data sets by serial number. 

Gyro misalignment and SF calibration requires a dynamic test, which is described 
later. 
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Gyro scale factor (SF) error and misalignments can be determined only through 
dynamic tests as described below. 

4.3.2 Dynamic Calibration Tests 


Certain gyro parameters (SF error, misalignments about Spin Axis (SA) and 
Output Axis (OA), anisoinertia) are determined from dynamic calibration tests (test 
program JIMK). Data is taken in three test positions, with the table rotated in both 
positive and negative directions. Five rotation rates are used in each sense chosen 
so that: 

cosa io. = sina uo. , i 
1 1+1 

Using this rule, the test conditions for all instruments reflect the same rate inputs. 

Upon completion of data collection (3 positions, 2 senses, and 5 rates yielding 
30 data sets), a DDP-516 program, DYNCAL, retrieves data from the disc, calculates 
the gyro error parameters (Table 4.3.3), arid displays and stores these values. 

Table 4. 3. 3 Rate Testing Equations 


General format of the 4-simultaneous equations required 


A 

GOi* 

+ 

B Pi + 

c 

SFGi- 


= D 

E 

GOi* 

+ 

F Pi + 

G 

SFGi- 


= H 

I 

GOi* 

+ 

J Pi 


+ 

KSFGi+ 

= L 

M 

GOi* 

+ 

N Pi 


+ 

PSFGI+ 

= Q 


where GOi* = output axis misalignment (Radians) 

/ 1$ a “ I A \ 

Pi - anisoinertia l ^ J (sec^) 

SF=Gi+ = gyro scale factors ^ 

4.3.3 Real-Time Operational Software and Verification 


The real-time operating software for the SIRU system comprises a complex 
of interacting routines coded in machine language. It is shown schematically in 
Fig. 4.3.3, SIRU Data Processing, and is described in detail in Volume III. This 
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itttmittit till tt it it it 


section bridges the gap between the schematic and the machine language routines. 
The routines themselves are also discussed. 



Fig. 4. 3. 3 SIRU Data Processing 


The computational requirements of a strapdown system are as follows: 


(1) Correct the raw gyro and accelerometer pulse counts by compensation 
routines to accommodate for the calibrated bias terms, misalignments, 
etc. 

(2) Derive the computational triad solution for body rotation and velocity 
increments through the matrix processors 

(3) Effect the failure detection and isolation equations, yielding current 
system failure status 

(4) Adapt separate gyro and accelerometer matrix processors to reflect 
current failure status (AG - gyro axis failures and AA - accelerometer 
axis failures) 

(5) Transform the body axis triad angular solution (A9 . A0 , AO ) to a 

x y z 

body frame with respect to inertial reference attitude indication, 
quaternion (q) four parameter representation 

(6) Transform the body triad velocity solution (AV. AV , AV ) to an inertial 

x y z 

velocity in the inertial frame 
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Other software subsequently added during the S1RU Utilization program and 
documented In R-747 included: 

(1) Single position calibration 

(2) Gyrocompassing routine 

(3) Statistical FDI software with on-line recalibration 

(4) Local vertical navigator 

Although these operations were identified in Chapter 2 , it must be recognized 
that the actual computation process is a complex procedure. The algorithms are 
divided into two sets > an accelerometer data processor and a gyro data processor. 

The system accumulates AV and AO pulses from the torque- to-balance 
instrument loops after initialization. With the system operating at 100 iterations 
per second the accelerometer and gyro pulse counters are processed every 10 
milliseconds (ms). Their processing, however, is interleaved so that the 10 ms of 
AV accumulation processing precedes the 10 ms of A0 accumulation processing by 
5 ms. The velocity and attitude algorithms are staggered in the same manner. 
This staggering is achieved immediately upon initialization by using the first 5 ms 
of A0 data after initialization in the first attitude algorithm iterations prior to a 
full 10 ms velocity update. 

The tasks accomplished during the accelerometer and gyro updates are listed 
here. To process the accelerometer outputs we require the system to perform the 
following tasks: 

Al) Read the status of the six counters 

A2) Compensate the output for average SF, bias and misalignments of each 
accelerometer f s input axis about its output and penduluous reference 
axes 

A3) Compensate the output for errors due to RuV and Ru? as a function of 
the accelerometer's position relative to the angular input 

A4) Accumulate the corrected output for the purpose of FDI 

A5) Perform FDI resulting in a current failure status 

A6) Check the parity equations for third fail 

A7) Create a least- squares matrix (as a function of fail status) to transform 
the six compensated AVs into the XYZ body frame 

A8) Do the 6x3 matrix multiplication 

A9) Unitize the attitude quaternion prior to velocity algorithm processing 



A10) Do the velocity algorithm i,e., use the current attitude quaternion to 
generate the velocity transformation matrix and transform the 
incremental body velocity into the inertial frame 
All) Accumulate AV inertial for output processing 


To processthe gyro outputs we presently require the system to perform the following 
tasks; 


Gl) 

G2) 


G3) 

G4) 

G5) 

G6) 

G7) 

G8) 

G9) 


Read the table encoder, and the six gyros and interpolator accumulators 
Compensate the output for ±SF, Null Bias Drift (NBD), Acceleration 
Dependent Input Axis drift (ADIA), Acceleration Dependent Output Axis 
drift (ADOA), Acceleration Dependent Spin Reference Axis drift (ADSRA), 
anisoelasticity, misalignments, anisoinertia, Spin Reference Axis (SRA) 
cross-coupling and OA coupling 
Accumulate the corrected output for FDI 

Perform the FDI processing resulting in a current failure status 
Check the parity equation for third fail 

Create the least- squares matrix (as a function of failure status) to 

transform the six compensated AGs into the XYZ body frame 

Do the 6x3 matrix multiplication 

Compensate for earth rate 

Update the attitude quaternion 


In the time remaining, the system status is documented either on the teletype, 
the CRT display or on an incremental magnetic tape for further analysis (Fig. 4,3.4). 
The information outputted includes the attitude quaternion, AVj accumulated over 
some interval, a squared error monitor and fail status for gyros and accelerometers, 
the test-table angle encoder output and time since initialization. 

Coding of these operations is divided among thirty subroutines and a main 
program which sequences and controls communication between them, A brief 
description of the software at this level appears in Appendix D. Volume III presents 
a detailed description, including listings and load maps. 

Each of these routines was subjected to extensive test verification and 

integrated system testing. For example end-to-end tests (12 to 60 hour duration) 

in a local vertical navigational mode have been repeatedly performed. In this test, 

the system software maintains an inertial reference by means of a quaternion, q 

* IB 7 

which represents and quantifies the rotation from the inertial to the current body- 
frame. A third order quaternion update algorithm is employed. The incremental 
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AVg is transformed into the inertial frame, and used to update inertial velocity 
and position estimates. 



Fig. 4. 3. 4 CRT System Status Display 


The test results are typically evaluated using a series of evaluation programs 
resident in the IBM 360/75 computation facility. 

Test data stored on the tape or disc and transferred to the IBM 360/75 for 
evaluation comprise real-time attitude, inertial velocity and inertial position 
estimates from SIRU software, and a record of table rotation over the test interval. 
Initial attitude, velocity and position are given. The record of table motion is 
processed by a third order quaternion update algorithm to yield a theoretical or 
"perfect" system attitude. This algorithm matches that of the SIRU software, but 
its input is free of gyro quantization and drift errors. The "perfect" attitude is 
used to process the specific force input due to gravity for "perfect" navigation. 
Comparison is made with the system's real-time record, both at the attitude and 
navigation (velocity and position) levels. As with the static tests discussed 
previously, the MAC language program includes a variety of options for reporting 
and plotting indices of performance. Thus this program provides a flexible tool 
for the- analysis of SIRU system performance from a variety of tests. Static, constant 
slew and oscillatory tests have been processed, and show good agreement between 
measured (SIRU) and computed ("perfect") performance. 
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5.0 SIRU Reliability Appraisal 


5.1 Observed Operational Reliability 


Table 5.1.1 presents a summary of the SIRU system hardware reliability over 
the period beginning 27 January, 19 70 and ending 19 November, 1971, During this 
period, the SIRU system was operated for 14,600 hours with a total of 71,000 gyro 
module operating hours and 88,000 accelerometer module operating hours. No 
simultaneous failures occurred. There were two gyro failures (January, 1971 and 
March, 19 71) and one gyro module PTE failure (April, 1971). One of the gyro failures 
was a gas bearing wheel non- start after 2811 wheel hours of operation and 1745 
wheel start/ stop cycles. The other gyro evidenced intermittent float hangups after 
5017 wheel hours of operation and 1914 wheel start/stop cycles. The PTE failure 
was due to a marginal solder joint (that degraded with time) at one of the scale 
factor (SF) resistor terminals. As a workmanship failure, it does not reflect on 
the PTE reliability as determined by the reliability of the PTE electronic components. 

It does, however, reflect a potential hazard that is not easily screened and represents 
a continuing reliability hazard to the system population. 

Table 5. 1, 1 SIRU System Hardware Reliability 

Data from 1/27 /70 to 11 / 1 9 / 7 1 Component Failures Operating Hours System Failures 

3 14,600 0 


' 

No. of 

MTBF 

Operating Hours 


Failures 

Measured 

90% Conf 

n Actual n 

Req r d* 

Gyro 

2 

35,500 

13,400 

71,000 

185, 000 

PTE 

1 

159,000 

40,700 

159,000 

620, 000 

Accelerometer 

0 

i 

88,000 

38, 300 

88,000 

202, 000 


Operating Hours required to demonstrate measured MTBF with 90% confidence 

Table 5.1.2 is a tabulation of estimates of failure rates for SIRU hardware 
components. The failure rates for the electronics were estimated using a component 
parts count of each circuit with electronic component failure rates based upon Apollo 
experience. The conservative failure rate of 75 x 10 failures /hr shown in the 
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gyro reliability range (Table 5,1.2) reflects the 13,400 hour MTBF value (at the 

90% confidence level) from Table 5.1.1. The measured MTBF of 35,500 hours for 

the gyros (Table 5.1.1) was used to determine the lower failure rate value of 28 x 

10 for the gyro shown in Table 5.1.2. (This estimate is also conservative because 

in this gyro population the wheel start problem was a known design deficiency that 

was subsequently resolved by a bearing material change). The failure rates shown 

for the accelerometer modules are conservative and were obtained by assuming 

that one failure did occur in the 88,000 hours of operation even though there were 

actually no failures during this period. The lower accelerometer failure rate given 

“ 6 

in Table 5.1.2 (11.4 x 10 ), corresponds to an assumed one failure in 88,000 hours. 

““6 

The pessimistic accelerometer failure rate (26 x 10 ) corresponds to the 90% 

confidence MTBF of 38,300 hours shown in Table 5.1.1. 

Table 5.1.2 SIRU Failure Kate Estimates 


Gyro Module: 

Gyro 

Gyro PTE, Interpolator & 8v Supply 
Temperature Control 
Wheel Supply 

Net Gyro Module Each Axis = X^ 

Accelerometer Module: 

PIP 

PIP PTE 8v Supply 
Temperature Control 

Net PIP Module Each Axis = X2 

Electronics Assembly (6 Axes Support): 
9600 Hz Supply 
DC Axis Supply 
Fuse /Diode Module 

Net Electronics x\ssembly - Xg 


Failure Rate,X 

(Failures per Hour) 
28-100 x 10 -6 
15 x 10“ 6 
3 X 10 -6 
11 x 1Q~ 6 
57-129 x 10" 6 


11.4- 50 x 10" 6 
12 x 10 -6 

3 x 10 ^ 

26. 4- 65 x 10' 6 


10 x 10" 6 
12 x 10" 6 


23 x 10" 6 


Electronics Assembly (Dual or Triple Redundant) : 
40/5 vdc Supply - X^ 

28 vdc Pre-Regulated = A,. 

Multiplexer - Ag 
Clock = X ? 

Scaler = Ag 


12 x 10" 6 
12 x 10" 6 
10 x 10" 6 
1 x 10' 6 
10 x 10" 6 
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5,2 theoretical Reliability Calculations 


Various SIRU reliability curves (reliability vs. mission time) are presented 
in Figs. 5,2,1 through 5.2.4 using the SIRU reliability criteria given in Table 5.1.3 
for defining hard and soft failures and the failure rates listed in Table 5.1.2, Included 
for reference on each plot is the corresponding reliability of a triad system having 
non- redundant components with the same failure rates as the SIRU components. 
Fig. 5.2.1 presents SIRU reliability for the soft failure configuration using the 90% 
confidence failure rates for gyros and accelerometers. Fig. 5.2.2 presents SIRU 
reliability for the hard failure configuration using the 90% confidence failure rates 
for gyros and accelerometers. Figures 5,2.3 and 5.2,4 repeat the two previous 
figures using the failure rates experienced during the test programs for gyros and 
accelerometers. 

These analyses are based on the following two assumptions: 

1. The FDI coverage, defined as the probability that a failure, having 

* 

occurred, will be detected and properly isolated, is 100%. 

As described in Chapter 2, the FDI can not only detect and isolate two 
failures of gyroscopes and accelerometers and detect a third failure, 
but can also isolate the third failure if it results in a substantially greater 
squared error than the previous failures. Thesoftfail analyses presented 
here assume that two failures only are detected and isolated. 

2. The SIRU equipment is in uninterrupted operation throughout the mission. 

Equations are derived separately for what we termed soft and hard failure 
systems. The term soft failure is defined to encompass performance degradations 
which can be isolated only by measurement comparisons (voting or FDI algorithms). 
Hard failure is used to describe faults which do not require voting for proper isolation. 
In general, these are catastrophic failures which can be isolated by self-test hardware 
(BITE) or reasonability type software tests. 

SIRU reliability equations are derived separately for systems which can tolerate 
different amounts of component failures. These two configurations are described 
in terms of what failures can be tolerated (Table 5,1.3). Soft failure systems are 
those in which FDI can isolate failures of only two measurement axes. Thus, up to 
two gyro and two accelerometer modules can be isolated automatically ££, two 


The reliability analysis in R-747 includes analysis of FDI coverage. 
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Fig* 5.2*3 SIRU Reliability - Soft Failures Experienced Failure Rates 

for Gyros and Accelerometers 



Fig. 5*2.4 SIRU Reliability - Hard Failures Experienced Failure Rates 

for Gyros and Accelerometers 
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electronic functional axes can be lost, with operation continuing. In addition , one 
of two scalers, one of two 40 vdc/5 dc supplies, one of two 28v supplies, one of two 
multiplexers and one of three clocks can fail without failing the system. 


Table 5 0 1.3 SIRU Reliability Criteria 




Tolerable Failure Combinations 



Soft Failure 

Hard Failure 

Device 

Redundancy Level 

System 

System 

Gyro Module 

6 

— • ■ ■ — i 

(2 Fails 
and 

(3 Fails 
and 

PI PA Module 

6 

2 Fails) 

3 Fails) 

Electronic Assembly 


OR 

OR 

Functional Axes 

6 

3 Fails 
and 

3 Fails 

Scaler & 40v ps 

2 

1 Fail 
and 

1 Fail 
and 

Oscillator 

3 

1 Fail 

2 Fails 

Critical Path: 




Module & Axes 


FO-FS 

FO-FO-FS 


FO = Fail-Operate 
FS - Fail-Safe 

Hard failure systems are those which include BITE and more extensive FDI 
(reasonability tests) etc. This hard category can tolerate the same non- axis- dedicated 
electronics failures, but will operate with up to three gyro or accelerometer modules, 
or three functional axes lost. The system will survive failure of two of the three 
clocks. 

The reliability curves in Figs. 5.2.1 through 5.2.4 were calculated as follows. 
(All failure rates used are those given in Table 5.1.2). 

5.2.1 Triad Reliability Calculations 

The following reliability functions are calculated for the reference triad curves 
shown on Figs. 5.2.1 through 5.2.4. Reliability of a single gyro module: 

R G - e 1 (5.1) 

where X^ * Net gyro module failure rate. 
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Reliability of a single accelerometer module: 



where X = Net accelerometer module failure rate. 


(5.2) 


Reliability of axis- dedicated electronics: 

r ae : 


" X 3 % 


(5. 3) 


where X^ = Net axis- dedicated electronics assembly failure rate. 


Reliability of the non-* axis- dedicated electronics: 


r nae = e 


■v 


where X^ = Net non -axis -dedicated electronics assembly failure rate, 

X q = X 4 + X 5 + X 7 + X 8 


(5.4) 


(5.5) 


where (see Table 5.1.2) the failure rate of 40 vdc/5 dc supply is X^, that of the 28 
vdc preregulator isX^., that of the clock is X^ and that of the scaler is Xg. 

The reliability, R-^^, of all of the triad electronics is given by: 


r ea “ r ae r nae 


(5.6) 


The reliability, R^, of the complete triad is given by: 


r t r g r a r ea 


(5.7) 


5.2.2 SIRU Reliability Calculations 


This section comprises the derivation of equations used in obtaining the specific 
SIRU reliability curves shown on Figs. 5.2.1 through 5.2.4. The derivation for 
soft and hard failure systems is presented later in this chapter. 


The SIRU reliability calculations are complicated by the particular relationship 
of the axis- dedicated electronics to the gyros and accelerometers. For each functional 
axis three dedicated elements, a dc supply, a 9600 Hz supply and a fuse and diode 
module, support both the corresponding gyro and accelerometer modules. Since 
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these electronic elements are not cross strapped, a failure in any of them results 
in the loss of both a gyro and an accelerometer. The reliability of the inertial 
package with no axis electronics failure is derived as shown in Eqs. 5.8 through 
5.10. The reliability of the axis- dedicated electronics is shown by Eq. 5.3. The 
reliability of the complete inertial package including the axis-dedicated electronics 
for soft failures is as shown in Eq. 5.11, 

This expression is conservative for it ignores several cases in which the 
system is unaffected by failures which Eq. 5.11 includes. For instance, if a gyro 
failure occurs followed by the failure of its axis electronics, the electronics failure, 
in effect, is partially forgiven. Another example is shown by a gyro failure followed 
by an axis electronics failure on another axis. While the limit of gyro failures has 
been reached, one more accelerometer failure can still be tolerated. Equation 5.11, 
to avoid computational complexity, does not include these small but definitely positive 
terms. 

Soft Failure Systems 

The reliability Rg GS of the six gyros modules in soft failure systems with no 
axis electronics failure is given by: 

R 6GS = R G (15-24R q + 10 Rq) (5.8) 


where R^, is given by Eq. 5.1. The reliability of the gyro package is given by the 
probability of four of the six gyros surviving. 


The reliability, Rg^g, of the six accelerometer modules for soft failure systems 
with no axis electronics failure is given by: 

R 6AS = R A < 15 - 24R a + 10R a ) (5 ' 9) 

where is given by Eq. 5. 2. 

The reliability, R^g, of the total inertial package (six gyro and six accelerometer 
modules) with no axis electronics failure is given by: 


R IS “ R 6GS R 6AS 


(5.10) 
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The reliability Rjg AE > of the total inertial package including the axis-dedicated 
electronics (see Table 5.1.3) is given by: 

g 

R ISAE = R AE R 6GS R 6AS 

+ 6R^ e (1 _ R ae )(R g + 5Rq (1-R g )) (R a + 5R a (1-R a )) 


+ 15 <e «- r ae> 2 r g r 1 


(5. 11) 


where is given by Eq. 5,3. 


The reliability, R nTr , of the dual redundant electronics is given by: 


R DE - R 4 R 5 R 6 R 8 


(5.12) 


where reliability of the 40/5 vdc supply is 


R = [l-(l-e ^V] 


(5.13) 


Reliability of the 28 vdc preregulator is 


-At 

R 5 = Ll-(l-e b ) 


(5.14) 


Reliability of the multiplexer is 


■t- 


(1-e 6 ) 


(5.15) 


and reliability of the scaler is 


-At 
(1-e 8 ) 


(5.16) 


A^, Aj. and are defined above, and Ag is the multiplexer failure rate. 

The reliability of the clock for this system R GS » is given by the probability of two 
of the three oscillators surviving: 

R CS = R 7 + 3R 7 (1 ' R 7 ) (5.17) 

where is the clock failure rate and 


R 7 * e 
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The reliability, ^he entire SIRU electronics assembly is given by: 


r eas r de r cs 


(5.19) 


The overall SIRU system reliability, R^, for soft failure systems, is given by: 


r ts " r isae r eas 


(5.20) 


where f* ISAE and R EAS are given and respectively. 

Hard Failure Systems 


The discussion with respect to axis- dedicated electronics failures for soft 
failure systems presented above applies in a similar fashion to hard failure systems 
and the resulting derivation is presented below* Derivation of the reliability of 
gyro and accelerometer arrays, and of the axis electronics, is also similar. One 
additional failure, however, can be tolerated. 


The reliability, °f the six gyro modules in hard failure systems with 

no axis electronics failure is given by: 

R 6GH = R G <20- 4 5R g+36 4 - 10R*> (5.21) 

where R^, is given by Eq. 5,1. 

The reliability, of the six accelerometer modules with no axis electronics 

failure is given by: 


R 6AH = R A < 20 ' 45R a + 36 4 - 10 (5.22) 

where R ^ is given by Eq. 5.2 

The reliability, R ih , of the inertial package (six gyro and six accelerometer modules) 
in hard failure systems with no axis electronics failure is given by: 


R IH R 6GH R 6AH 


(5.23) 
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The reliability, of the total inertial package including the axis- dedicated 

electronics (Table 5.1.3) is given by: 


R IHAE " R AE R 6GH R 6AH + 6R AE * 1_B AE^ R G + 5 R G * 1-R G^ 
(R A + 5R A < 1_r a )) 


+ 15r4 ae <>' r ae> 2 < r g + 4R c. |1 ' r g»> 


(5.24) 


,R I +4R 1 (1 - r a>> 

4 zor 1e (1 - r ae> r g r ! 


where is given by Eq. 5.3. 


The reliability of the dual electronics for this system is the same as for the 
soft failure case (Eq. 5.12). 


The reliability, of the clock for the hard failure case (failure of two 

oscillators may be tolerated) is given by: 

R CH = R 7 + 3R 7 <1-R 7 ) + 3R 7 (1-R ? ) 2 (5.25) 

where R, is defined by Eq. 5.18. 

The reliability, of the entire SIRU electronics assembly is given by: 

R EAH = R DE R CH (5.26) 

The overall SIRU system reliability, Rrpjj, in a hard failure system is given by: 

R TH = R IHAE R EAH (5.27) 

where and are given by eqs. 5.23 and 5.26 respectively. 

5.2.3 Theoretical Results 


These equations have been evaluated and plotted using both 90% confidence 
level and experienced MTBF values. Results are plotted in Figs. 5.2.1 through 
5.2.4. The conclusion which must be drawn from this study is that the SIRU 
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configuration is notably more reliable than a gimbaled triad system built with similar 
components. 

5.3 Reliability Analysis Summary 


The equations presented above and graphs (Figs. 5.2.1 through 5.2.4) have 
been used to derive the probability of mission success and equivalent MTBF for 
the SIRU and triad systems for a period of 730 hours (one month). See Table 5.3.1 
where the equivalent MTBF numbers were computed using the following equation: 

Equivalent MBTF = (5.28) 

where R is the corresponding system reliability at 730 hours as computed from 
Eqs. 5.7, 5.20, or 5.27. 

Table 5, 3, 1 Reliability Analysis Summary 


MISSION TIME 
730 HRS. 


SIRU 

SYSTEM 


TRIAD 



MISSION SUCCESS 

EQUIVALENT MTBF 
IN HRS: 

SOFT 

FAILURES 

HARD 

FAILURES 

SOFT 

FAILURES 

HARD 

FAILURES 

90% CONFIDENCE 
FAILURE RATES 

.9779 

.9981 

32,767 

347,619 

EXPERIENCED 
FAILURE RATES 

.9959 

.9997 

178,000 

2.433,333 

90% CONFIDENCE 
FAILURE RATES 

.5874 

1370 

EXPERIENCED 
FAILURE RATES 

.7664 

2740 
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6.0 Test Facility 


6. 1 Introduction 


This section contains a description of the facility and subsystem equipment 
developed to operate and evaluate the performance of the SIRU system. Section 6.2 
describes the test table setup including the system optical alignment features. Section 
6.3 provides descriptions of the GSE console and accessory electronic interfaces. 
Figure 6.1.1 shows the complete interface for SIRU and the associated support 
equipment. The computer facility components shown in the figure are an integral 
part of the overall test facility. See Chapter 4 for a discussion of the computer, 
its SIRU system interfaces and the associated peripherals. 



Fig. 6.1.1 SIRU System Block Diagram 
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6.2 Test Table 


The test table provided to support the SIRU system consists of a 2-axis, 16 inch 
rotary table mounted on the rotating axis of a similar 2-axis 32-inch rotary table 
(both tables are manufactured by the International Machine and Tool Co.). Figure 
6.2.1 shows the major components of the test table system. The four table axes 
are equipped with precision (0.5 sec resolution, 2.0 sec accuracy) optical readouts 
which allow positioning to a wide range of orientations including the six basic 
instrument calibration positions. The rotary axis of the 32-inch table is equipped 
with a rate drive system which can generate constant slew rates up to 1.0 rad/ sec 
and oscillatory rates at frequencies up to 10 Hz. See Fig. 6.2.2 for a sketch of the 
slip ring and encoder assembly. 

TEST TABLE SUP RING & ENCODER ASSY 


r 




Fig. 6, 2. 2 Test Table Slip Ring & Encoder Assembly 

The S1RU system can be aligned to within 10 sec in azimuth and 5 sec in 
elevation in all desired test positions. These alignments are accomplished by 
orienting the SIRU system (by autocollimation on the system reference cube) with 
respect to transfer lines from the azimuth reference (porro prism). See Fig. 6,2.3 
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Fig. 6. 2. 1 Axis Test Table Assembly with SIRU System Installed 
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for the optical alignment layout. Figure 6.2.4 shows the SIRU system installed on 
the test table. 



Fig. 6, 2. 3 Test Facility - Optical Alignment References 
6. 3 Support Equipment 


Ground Support Equipment (GSE) for the SIRU laboratory installation consists 
of the following items of equipment: 


I. GSE Console 

II. Interconnect Box (ICB) 

III. Table Junction Box (TJB) 

IV. RIP Test Box 

V. Monitor Console 


A description of each item, their subassemblies and their application to the 
operation and test of the SIRU follows. 

6.3.1 The GSE Console 


The GSE console. Fig. 6.3.1, provides the necessary dc power sources and 
distribution for the SIRU system. It controls the moding of the system, provides 
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Fig. 6. 2. 4 SIRU System Installed on Test Table 



Fig. 6. 3. 1 GSE Console 
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auxiliary heat for inertial components, and monitors component temperatures. It 
also provides access to system test points and ac and dc power for GSE operation. 

The console consists of six interlocking sections: 

A. Temperature Monitor 

B. Mode Control Panel 

C. GSE Heat Control Panel 

D. Power Distribution Panel 

E. Power Supplies 

F. Test Point Panel 

Temperature Monitor 

All inertial module temperatures are sensed in bridges and the amplified signal 
from each bridge is multiplexed to the monitor panel via the slip rings on the table 
once every 30 seconds. Signals are cycled through and displayed as a deviation 
from normal operating temperature. The inertial component being monitored is 
identified on the panel. Automatic scanning can be interrupted and manual sequencing 
invoked. Aural and visual alarms are activated if the temperature of any inertial 
component exceeds its specific limits, the faulty instrument is identified and the 
entire inertial system is automatically switched to a safe operating mode. 

Mode Control Panel 

The Mode Control Panel provides all the power switching devices required to 
control the various operational modes of the SIRU system. The Turn-On/ Turn-Off 
sequence is interlocked and all critical points in the system and the GSE are channeled 
into the Mode Control Panel to insure safe system operation. 

GSE Heat Control Panel 

As described below, certain modes of operation require that extra heat be 
delivered to the inertial components. The GSE Heat Control Panel provides this 
extra heat individually to each component. This heat is adjustable and is available 
in two modes: preheat and fixed heat. Preheat is used when extra power is needed 
to bring the component up to operating temperature before tui'n on. Fixed heat was 
provided as an additional power source to assist the component temperature 
controllers when several modules have been removed to minimize the effect of a 
ff-frame temperature gradient. 
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Power Distribution Panel 


All the heavy current switching Is done In the Power .Distribution Panel under 
the command of the Mode Control Panel. Safety fusing and over-voltage crowbar 
circuitry are also located here. All power and grounds are distributed from this 
point to the GSE and SIRU system. 

Power Supplies 


The GSE console contains the following power supplies. The associated usages 
are identified. 

1. +28 vdc - GSE relays and lamps 

2. +28 vdc - SIRU temperature, control, clock, and scaler, 40/5 supply, 
9600 Hz supply 

3. +28 vdc - SIRU dc axis supplies 

4. +28 vdc - SIRU accelerometer pulse torque electronics 
Test Point Panel 


The Test Point Panel provides necessary buffering for all available system 
test points used for troubleshooting and system monitoring. (This panel was used 
in Phase I only.) 

6.3.2 Interconnect Box (ICB) 


The ICB is mounted with the SIRU system on the test table and interfaces the 
system to the slip ring assembly. The circuitry in the ICB includes wheel current 
monitors with out" of- tolerance alarms, A3 multiplexers, AV multiplexers, gyro 
interpolator multiplexers, pulse buffers, and mode controls for the clocks and scalers. 
All available system operational test points can be monitored through the buffers 
in the ICB. 

6.3.3 Table Junction Box (TJB) 


All the raw inertial data (A6, AV, interpolator) which were multiplexed in the 
Interconnect Box for transmission through the slip rings are de- multiplexed in the 
TJB. This raw data are then buffered and sent to the computer for processing. 
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6.3.4 RIP Test Box 


This small box is located between the Electronic Assembly (EA) and the 
Redundant Instrument Package (RIP) and contains dc current sensing resistors, wheel 
current sensing transformers, and switches to control the gyro and accelerometer 
pulse torque electronics. 

6.3.5 Monitor Console 

This single bay console contains oscilloscopes for monitoring ail gyro and 
accelerometer error signal Lis sajous patterns, a digital voltmeter for troubleshooting 
and test table rate servo power supplies and controls. 
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PRECEDING page blank not filmed 


7.0 System Test Results 

This chapter describes and presents the results of system tests performed 
to evaluate and confirm the operation of the SIRU system. A companion document, 
SIRU Utilization Report, R-747, describes in additional detail the test program and 
results for single position calibration (SPC), Local Level Navigation and Coarse 
and Fine Alignment. Thus, only selected samples of test results in these areas 
are included here. 

The performance of the failure detection and isolation (FDD and of the statistical 
FDI Classification and Recompensation (FDICR) is covered in the chapters of this 
report and R-747 which are devoted to those subjects, and does not appear in this 
chapter. 

Test results from inertial components and gyro and accelerometer modules 
operated outside of the system environment are covered in the appropriate volume 
of this report; Volume II for gyros and gyro modules and Volume IV for ac- 
celerometer and accelerometer modules. 

Reliability operating results and assessments are presented separately in 
Chapter 5 of this report and for the SIRU Utilization program in R-747. 

With the exceptions described above, this chapter contains the principle results 
of the SIRU test and evaluation program for the entire period from July 1970 through 
December 1972. 

7. 1 System Operating Summary 

This section presents the operating summary of the system over the entire 
test period. The SIRU gyros in the system, through December 19 72, accumulated a 
total of 116,400 operating hours and a total of 694 system wheel stop- starts. The 
accelerometers accumulated a total of 147,800 operating hours with every instrument 
operating in the system in excess of 23,000 hours. Operating time for the system 
was 23,300 hours with a complete complement of instruments and the electronics 
assembly. 

7. 2 Calibration and Stability Data 

This section presents results from calibration tests and shows short and 
long-term instrument stability and the effects of system cooldowns and module 
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replacement. Accelerometer data, because of its security classification, have not 
been included in this volume but are presented in Volume IV of this report. 

7.2.1 Gyro Torque-to- Balance Stability Statistics 

Figures 7.2.1 and 7.2.2 summarize stabilities of bias drift (NBD), g- sensitive 

o 

drifts (ADSRA, ADIA and ADO A), g or compliance drift, scale factor (SF) and input 
axis alignments obtained across remounting, cooldowns and test repetition. 

The delta drift, or change in drift magnitude, alignment and SF have been 
tabulated and an rms average calculated for the sample size to show the effect of 
module remounting (Column 1) and of system cooldowns (Column 2). The larger 
sample size of the cooldown data results because all installed instruments are affected 
by a system cooldown whereas remounting affects only individual instruments. 

A comparison of the g-sensitive drift for these two cases shows nearly identical 
performance; that is, both the spread in delta magnitudes and the calculated rms 
values for each term are similar. This is to be expected, as the environmental 
impact on the instrument is nearly the same in each case (all power off). There is 
no apparent effect from the physical movement of the module during remounting. 
These g-sensitive drift changes across cooldown are a deficiency of the 18 IRIG 
Mod B gyro population used in SIRU. An improved instrument, the 18 IRIG Mod D, 
with a redesigned, integral wheel and gimbal (described in Volume II) has substantially 
reduced this sensitivity* The equivalent performance of the Mod D across cooldowns 
is documented to be on the order of ,0l5°/hr. 

The tabulation of standard deviations (Column 3) for the various terms is 
derived from one to six months of calibration test results chosen to exclude all 
interposing cooldowns or remounts. This data is considered to be representative 
of the performance across cooldowns expected with the incorporation of the 18 IRIG 
Mod D or an equivalent instrument. 

The SF and alignment stability performance, for all three cases, is very 
respectable, and the standard deviations are indicative of the stability of the hardware 
and the sensitivity or resolution of the calibration and data reduction process. As 
explained in subsequent sections, reductions in SF differences across mounting have 
been achieved through implementation of hardware modifications, and reductions in 
alignment differences across mounting can be achieved through the use of an optical 
calibration fixture. 
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Table 7,2.1 shows the average sigma of the drift stability applicable to each 
instrument in five of the test positions shown in Table 7.2.2, This data was derived 
from overnight and weekend test runs of approximately 1-6 hours to 60 hours duration. 
Statistically, the system performance is seen to be relatively unaffected by position 
with respect to gravity. 


Table 7. 2. 1 

Average Sigma of the SIRU System Overnight 
Stability Data 


Axis 

Gyro j 

Pos#l 

N 

Pos#2 

N 

Pos#3 

N 

Pos#4 

N 

Pos#6 

N 

A 

MB-424A 

6.08 

7 

6, 06 

11 

1. 98 

3 

2.97 

3 

3. 16 

6 

B 

MB-426A 

9* 39 

7 

8. 68 

10 

5. 67 

3 

1,78 

4 

3. 06 

7 

C 

MB-425 

3. 41 

7 

2. 88 

10 

6, 72 

3 

7. 48 

3 

2. 31 

5 

D 1 

MB-428B 

3,42 

1 

2. 91 

2 

— 

— 

4. 35 

1 

— 

— 

E ! 

MB-421 

6. 00 

4 

4. 20 

9 1 

3.48 

3 

2. 49 

1 

5. 31 

4 

F ! 

MB-420A 

3* 14 

6 

2.43 

9 1 

2. 02 

3 

1.71 

3 

3.90 

7 


Values in °/hr x 10 

N: Number of Overnight or Weekend Test Runs 


Representative data for the A, D and F axis gyros in calibration position 2 
are shown in Figs. 7.2,3 through 7.2.10. Figures 7.2.3 through 7.2.5 show three 
drift stability calibration tests on the A gyro in calibration position 2 taken in May, 
September and November, 19 72. The module is oriented with its output axis (OA) 
horizontal, sensing almost full negative earth rate and exhibiting gyro bias drift 
and both ADI A and ADSRA magnitudes and stabilities. The standard deviations of 
the drift stability data for the three samples are .0040, .0045 and ,0041°/hr 
respectively. Figures 7.2.6 through 7.2.8 show the results of the same sequence of 
tests on the D gyro. In the calibration position 2, the D gyro module is oriented 
with its OA horizontal, sensing almost 9°/ hr earth rate and exhibiting gyro bias 
drift and both ADIA and ADSRA magnitudes and stability. The. standard deviations 
of the drift stability data for these three samples are .0027, .0020 and ,0020°/hr 
respectively. Figures 7.2.9 and 7.2.10 show the F-gyro with a one sigma stability 
of less than 0.0015°/ hr. In the calibration position 2, the F-gyro module OA is 
vertical and oriented so that it senses approximately 4°/hrof earth rate and exhibits 
essentially its bias drift magnitude and stability. When the F-gyro is placed in 
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RA1 = ROT. Axis 32" Table 
RA2 * ROT. Axis 16" Table 
TA1 = TRUN. Axis 32" Table 
TA2 * TRUN. Axis 16" Table 



Note : Positions 2, 4 & 6 are the Basic Positions for Rate Testing 


Table 7. 2. 2 Gyro and Accelerometer Static Calibrate Positions 
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EQUIVALENT INPUT ( /hr.) 



Fig. 7,2.3 A-Axis Gyro Drift Stability, May 3, 1972, Cal Pos 2 



Fig. 7,2.4 A-Axis Gyro Drift Stability, September 18, 1972, Cal Pos 2 


6 




EQUIVALENT INPUT <°/hr. ) 



Fig. 7.2.5 A-Axis Gyro Drift Stability, November 9, 1972, Cal Pos 2 



Fig. 7.2.6 D-Axis Gyro Drift Stability, May 9, 1972, Cal Pos 2 
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EQUIVALENT INPUT ( °/hr. ) 



Fig. 7.2.7 D-Axis Gyro Drift Stability, September 18, 1972, Cal Pos 2 



Fig. 7.2.8 D-Axis Gyro Drift Stability, November 9, 1972, Cal Pos 2 
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calibration position 6 (Fig. 7.2.11), the one sigma stability degrades to 0,0048°/hr. 
In calibration position 6, the F- gyro module is oriented with its OA horizontal sensing 
about 5.5°/hr of earth rate and exhibiting bias and both ADIA and ADSRA drift 
magnitudes and stabilities. Comparison of the F-gyro data in the two calibration 
positions illustrates the effect of the major g- sensitive drift terms on the short 
term performance of the instruments. 

A transient type instrument failure that was observed in system testing is 
illustrated in Fig. 7.2.12. The data was taken on the E- gyro which had been randomly 
identified as a failure by the SIRU FDI software. This plot confirmed the transient 
failure phenomena. The unit remained in the system for continued monitoring, and 
additional random, real "soft 11 failure events were observed by the FDI software. 
The plot indicates that the instrument float was restrained at the initiation of the 
test and experienced an exponential return to the nominal drift level (for that 
orientation) over the first six to eight hours of the performance test. The one 
sigma drift value of 0.048°/ hr and the visible roughness of the point-to-point 
performance during the remaining fifty hours of the test are indicators of a probable 
contaminant in the flotation fluid of this instrument. Subsequent tear down of this 
unit verified the presence of a contaminant. 

7.2.2 Day-to-Day Gyro Drift Stability 

The error in earth rate sensed by each of the system gyros in calibration 
position 2, on a day-to-day basis, is shown in Figs. 7.2.13 and 7.2.14. The instrument 
compensation routine (RPOTT) was utilized in these tests so that all the indicated 
rates are free of drifts caused by the nominal calibrated gyro drift, etc. parameters. 
There were no system cooldowns between the compensation updates. 

For the entire population over the three month period, we observe from these 
curves that the maximum data spread was better than 0.09°/hr including the sudden 
shift in F-gyro performance and the ramping in the D-gyro. On the average, the 
day-to-day performance is better than 0.015°/hr. It should be noted that gyro axes 
A through D in this calibration orientation reflect g- sensitive as well as bias drift 
stabilities since their input axes (IAs) and spin axes (SAs) have sizable components 
along the g vector. 

Both the E and F-gyros, whose OAs are vertical, indicate superior repeatable 
day-to-day drift performance, a maximum spread of 0. 00 7°/hr (except for the F-gyro 
calibration shift); this data correlates closely with the overnight stability data (Figs. 
7.2.9 and 7.2.10). If the stable drift shift of 0,09°/ hr for the F-gyro occurred during 
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EQUIVALENT INPUT (°/hr. ) 



TIME (HOURS) 

Fig. 7.2.11 F-Axis Gyro Drift Stability, September 19, 1972, Cal Pos 6 
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Fig. 7.2. 12 E-Axis Gyro Drift Stability, March 15, 1971, Cal Pos 2 
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Fig. 7.2. 13 Earth Rate Components Sensed by System Gyros in Cal Pos 2: Day-to-Day 
Stability for Compensated Gyros (Drift Terms* Scale Factor Errors and 
Misalignment Angles) 
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Fig. 7. 2. 14 Earth Rate Components Sensed by System Gyros in Cal Pos 2: Day-to-Day 
Stability for Compensated Gyros (Drift Terms, Scale Factor Errors and 
Misalignment Angles) 
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an operational period, the statistical failure detection routine would have detected, 
isolated, classified and recompensated this instrument. Recompensation to better 
than ,007°/hr has been demonstrated in laboratory testing-. This characteristically 
better performance in the OA vertical orientation provides the performance base 
for the self- calibration features of the SPC procedure that has been implemented 
under the SIRU Utilization program, R-747. 


7.2.3 End-to-End Gyro Drift Summation Repeatability 

After "Dumping" System in the Gravitational Field 


Table 7.2.3 shows the baseline net drift (all compensation terms applied and 
the a priori earth rate drift subtracted) sensed by the system gyros in calibration 
position 2. The system is then rotated about the Z-axis (horizontal) such that the 
X-axis is now vertical up (calibration position 1). The calibration position 1 data 
shows a maximum drift error of -0.0228°/hr in the E-gyro while the majority of 
units indicate better than 0.015°/hr. This stability across up-to-down rotation in 
the g field is indicative of a well calibrated system. 


Table 7. 2. 3 


SIRU Gyro Drift Rate Errors (With Drift Parameter 
Compensation Applied)— For the Cal Pos 2 
System "Dumped" to Cal Pos 1 and then back to Cal Pos 2 


System 

Orientation 

A 

System Axis 
B ” C D 

E 

F 





°/hr 




Calibration Position 2 
(Baseline) 

0060 

i 

o 

»-*■ 

-.0026 

.0039 

.0030 

-.0015 

Calibration Position 1 
Positioned System 180° 
About Z-Axis 

-•0032 

0063 

. 0202 

0054 

-.0228 

. 0116 

Calibration Position 2 

-•0093 

0034 

-.0062 

.0092 

-.0062 1 

0015 

Calibration Position 2 
Error With Respect To 
Baseline 

-•0033 

.0076 

-.0036 

. 0052 

-. 0092 

0 



X 


CAL. POS. 2 CAL. POS. 1 
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Upon returning again to calibration position 2, each gyro's net drift is again 
calculated. The maximum error with the gyros returned to their original orientation 
is .0092°/hr and the average return accuracy is within 0.005°/hr of the previous 
calibration position 2 drift summations. This small change is primarily due to the 
effect on the module electronics of the thermal gradients generated within the module 
by "dumping". 

7.2.4 Gyro Scale Factor Linearity 

Figure 7.2.15 is typical of the system's positive and negative SF linearity 
over the range of 0.09 rad/sec to 0.38 rad/sec for each of the SIRU gyro modules. 
Note that the plus and minus SF foreach gyrois different, and each gyro's deviation 
from nominal is different. In the system implementation each gyro pulse update is 
corrected by the compensation software for a calibrated deviation from nominal 
for both its plus and minus SF corresponding to the plus and minus 0.125 rad/ sec 
input. The linearity curves, therefore, reflect the error propagation from the 
calibrated value. This data was obtained by extending the dynamic calibration 
program (JIMK) to include the extra rate inputs required. The maximum spread 
for all system axes is approximately 50 ppm over the range of test rates. 
Incorporation of the point- slope compensation routine, developed and implemented 
on the SPOT program (NASA Contract NAS9- 6823) and reported in Draper Laboratory 
report R-743, would reduce the SF deviation from the compensated value for these 
instruments to approximately 10 ppm for input rates up to 1 rad/ sec. 
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7.3 Component Test to System Test Parameter Transfer 

In general, transferability with reasonable performance has been achieved 
(see Figs. 7.2.1 and 7.2.2) during the course of the test program. However, problem 
areas were encountered in the demonstration of transferability of module calibration 
data between the gyro or accelerometer module normalization test area and in 
subsequent tests after installation in the system. These problems and corresponding 
recent test findings that indicate that significant improvements are obtainable are 
reviewed below. 

7.3.1 Gyro Module 

A review of the non-g- sensitive (BD) gyro drift across transfer from the gyro 
laboratory tests to SIRU system tests shows an rms value of .06 degrees per hour. 
Recent efforts have shown this discrepancy to be the result of variations in transistor 
leakage in the pulse torque- to- balance loop H switch dependent upon the residual 
polarity of the switch after torquing. In addition, an error in one of the data reduction 
programs was uncovered that introduced an uncertainty of approximately 0.1 2°/ hr. 
This error, when combined with the polarity dependency, appears to account for 
the BD transferability discrepancies. Special system tests conducted since isolation 
of these causes have shown a maximum delta BD of .03 degrees per hour between 
the module and system tests. This magnitude can be further reduced in the future 
by modifying the calibration and system compensation programs and the computer 
interface so that the BD compensation will be able to correct for H switch polarity 
leakage dependency. The interface modification would enable the separate ac- 
cumulation of plus and minus AO pulses in each input/ output (I/O) iteration. This 
I/O modification would enable tracking of the individual polarity states of the torquing 
circuits and permit the implementation of a precise software compensation routine 
for the dual BD magnitudes. 

Torquer SF shifts (approximately 150 ppm) between module and system tests 
had been evidenced and were investigated. TheSF magnitude was found to be sensitive 
to variations in the level of the 40v excitation between the component test area and 
the system test area. Tests were conducted with several pulse torque electronics 
(PTE) modules in SIRU gyro module #10 to evaluate: 

1) DC amplifier circuit stability 

2) SF sensitivity to 40v dc supply variations 

3) SF stability 

4) SF linearity 

5) SF sensitivity to RC network tuning 
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Modification of the dc amplifier compensation combined with an increase in 
the padded resistance of the torquer circuit and resistive tuning of the torque r circuit, 
has proven successful in desensitizing the SF to variations in the 40v excitation. 
Tests with a modified module have demonstrated a significant improvement; the 
delta SF between module and system tests was reduced to a maximum of 13 ppm. 

Transfer of alignment from laboratory to system mounting has not been fully 
verified, although module alignment repeatability after a system alignment calibration 
and then across a subsequent removal of the module with a cooldown and remounting 
has been excellent, e.g., an rms of 8 sec and a maximum spread of 20 sec. The 
demonstration of absolute transferability of alignment calibration between the 
laboratory and system has been limited by the non- availability of the precision optical 
calibration fixture mentioned earlier, (design and assembly of such a gauge was 
not effected during this program because of fiscal and time constraints) that could 
be installed in each system rframe module location. This fixture would enable 
the determination of the frame pad alignments with respect to the system reference 
optical cube and allow correlation of laboratory and system data. In general, the 
limited correlated test work devoted to replacement of different modules in the 
same frame slot indicates that the absolute transferability is on the order of 4 
sec. 

7.3.2 Accelerometer Module 


The variation in accelerometer bias from laboratory test to system test has 
been acceptable with an rms value of 21 micro g’s. The rms value of SF deltas 
from laboratory to system operation is 29 ppm. No attempt has been made to reduce 
this value. If an application requirement for a better SF match existed, a task 
could be initiated to reduce this value to less than 15 ppm rms (conservatively 
estimated). The status of alignment transfer for the accelerometer module is the 
same as for the gyro module. 

7.4 Real-Time Attitude Error Propagation 

Tests were conducted with various combinations of zero, one and two instrument 
failures in static and dynamic environments to determine the error propagation 
characteristics of the redundant system. Tests wei'e run with the body axes X, Y, 
and Z vertical and down. Constant angular rates of 0.4, 4, 10, 16, 26 and 40°/ sec 
in both directions and oscillatory tests of 0,25 Hz,20° p-p, 0.50 Hz,15° p-p, 3.0 Hz, 
3/4° p-p, and 5.0 Hz, 1/4° p-p were conducted. 
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The representative data included in this section are presented as the attitude 
error between the body (true) and computed (system error) reference frames as a 
function of time. The predominant dynamic errors appearing in the plots are due 
to OA coupling and pseudo-coning. Other dynamic errors due to SA cross coupling, 
anisoinertia, and SF errors are present to a lesser degree. A large repeatable 
error appearing in these plots is due to a test table encoder error of 80 set: peak 
to peak over one table revolution. 

7.4.1 Static Quaternion Attitude Tests 

Figure 7.4.1 is typical of the static test results. Even though the test duration 
is only 14 hours, a 24 hour period in the X, Y and Z attitude errors can be observed. 
The error in the quaternion is quite small, a maximum of 2.5 milliradians in the 
14 hour period is shown on the X-axis. This corresponds to a gyro drift 
mis compensation and cross coupling error that is equivalent to less than a 0.01°/hr, 

7.4.2 Constant Angular Rate Tests 

Inputs, during dynamic testing, were impressed about the X, Y, and Z body 
axes. No multiple axis testing was included. 

Figures 7.4.2 through 7.4.4 present closure errors for the quaternion attitude 
expressed in terms of SF error for the X (input) axis and equivalent misalignment 
errors for the axes perpendicular to the rate vector. With respect to Figs. 7.4.2 
and 7.4.3, the equivalent system alignment uncertainties correspond to those 
out- of- plane angles, which, when operated on by the total angle traverse accumulated 
about the X-axis, would yield the observed error in the output of the attitude algorithm 
axes that are orthogonal (Y and Z) to the rotational axis X. As seen from these 
figures, the equivalent system alignment uncertainty was well bounded, approximately 
10 s / ec, regardless of the failure combination. It is very interesting to note, however, 
that when the E and F-gyro axes were failed, i.e., not used in the least- squares 
processing matrix for the triad solution, the equivalent misalignment errors were 
essentially nulled. 

This result is indicative of a miscalibration load error in either the E or F 
instruments. Analysis of the equation structure for the four- instrument processing 
equations. Appendix A, shows that the F-gyro weighting becomes more dominant 
with the failure combinations that were exercised. The F-axis data in the Y-axis 
triad solution with gyro A and D failed increases in weighting from 0.425 with no 
failures to 0.638. Similarly, in the Z-axis solution, weighting increases from 0.425 
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Fig. 7.4. 1 14-Hour Attitude Test-No Instrument Failures (Cal Pos 2) 


(pq (Z-axis attitude errors expressed in equivalent misalignment offset) 

V GQ 



Compensation Load: NL109(with OA Coupling Compensation) 


Fig. 7 0 4,2 End-to-End Quaternion Attitude Tests (Cal Pos 2) 
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Compensation: NL109 (with OA coupling compensation) 


Fig. 7. 4. 3 End-to-End Quaternion Attitude Tests, Cal Pos 2 
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Fig. 7,4.4 End-to-End Quaternion Attitude Tests, Cal Pos 2 
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to 0.607 with gyro A and D failed. Considering the foregoing factors, the relative 
test time for the different rotational rates and the number of revolutions, it appears 
that the equivalent system alignment spread in the data shown was primarily due to 
an approximately 0.03°/ hr drift calibration error in the F-gyro. This is not unexpected 
since no special care was taken to obtain a precise calibration load prior to this 
test sequence. In addition, in the calibration sequence run 14 days after these 
performance tests, an F- gyro drift performance change from the previous calibration 
of 0. 1 8°/hr was observed. The F -gyro instability was eventually traced to a random 
malfunction in the torquing electronics causing variance type bias performance failure 
phenomena. 

With regard to Fig. 7.4.4, the equivalent system X-axis SF error was defined 
by comparing the attitude algorithm output X-axis error to the total angle rotation 
of the X-axis. Recall that the compensation algorithm used in SIRU corresponds to 
a nominal SF calibration at approximately 0.125°/sec, From the test data in the 
figure, across all of the combinations in the rate region between 4 and 40°/ sec, the 
equivalent SF error is quite small, a spread of approximately 10 ppm. This 
performance is consistent with the SF linearity performance for individual 
instruments shown in Fig. 7.2.15. The roll off at lower rates (0.4°/sec) is also 
consistent with data observations on individual instruments and generally relates 
to the uncertainties introduced in the estimation of SF calibration at low rates by 
the gyro drift calibration uncertainties. The 50 ppm drop across the no failure and 
E and F-gyro failure conditions is therefore consistent with the test calibration 
condition. The system SF performance is well bounded and reflects the general 
quality of the system gyro torquing performance. Use of a SF linearity compensation 
routine, as discussed previously, would have yielded improved performance. It is 
interesting to note that the A and D-gyro failure combination resulted in an increase 
in the equivalent SF error at the low rates of about 40 ppm. Once again, this result 
appears tocorrespond to the bias compensation error in the F-gyrosince the X-axis 
triad solution weighting does not use the F -gyro when there are no failures. However, 
with A and D-gyro failed, it is scaled to 0.557. 

Figures 7.4.5 through 7.4,8 present quaternion attitude as a function of time 
with and without OA coupling compensation and with no failures. 

The effect of OA coupling errors, resulting from a step rate input, in terms 
of the error in the indication of the inertial frame is evidenced in Fig. 7.4.5. As 
expected, an inertial frame error in the Y and the Z axes occurs that corresponds 
to the change in rate applied about the X reference triad axis. The rate change 
affects the E and F instruments which have their OAs colinear with the X-axis. It 
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Fig* 7.4.5 Constant Rate Test about X-Body Axis (Static - 3 Rev 
Slew - Static), Cal Pos 2 



Fig. 7.4.6 Constant Rate Test about X-Body Axis (Static - 3 Rev 
Slew - Static), Cal Pos 2 
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i Fig. 7.4,8 Oscillatory Input about X-Body Axis, Cal Pos 2 
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results in an erroneous E and F-gyro output and a corresponding error in the Y 
and Z triad solution. This output is proportional to the OA coupling coefficient. 
The Y and Z axis solution error results in the sinusoidal Y and Z error curves. 
Fig. 7.4.5. These error curves correspond to the indication of the Y and Z body 
axis orientation with respect to a perfect non- rotating inertial frame. The Y and Z 
axis sinusoid errors are 1200 //rads peak to peak, and the sinusoidal error in the X 
axis corresponds to the table encoder calibration error (80 sec, 400 //rad). When 
the table rotation is stopped, an opposite polarity change of rate occurs with a 
corresponding E and F-gyro output that returns the inertial indication to the correct 
orientation with no net error due to OA coupling. The net offsets at the end of the 
test are primarily due to SF and alignment error propagation. With OA coupling 
compensation implemented in software, the magnitude of the attitude error in the Y 
and Z axes for the same input rate step was reduced to 400 ^rads peak to peak. 
Fig. 7.4.6. 

The variation in OA coupling error between tests is attributable to the manual 
setting of angular rate and rate magnitude (i,e., variation in w magnitude and time). 

The effect of OA coupling error in an oscillatory environment is dramatically 

presented in the quaternion attitude plot of Fig. 7.4.7. The Z-axis attitude drift, 

* 

termed pseudo-coning, results when the algorithm receives information from the 
instruments for apparent oscillatory inputs 90° out of phase and of the same frequency 
about two axes (X and Y). The X-axis oscillation is the true sensed input and the 
Y-axis oscillation is the false information caused by the OA coupling error of the 
E and F-gyros. The Y-axis sinusoid is the direct result of the OA coupling error 
term and the X-axis sinusoid is a function of the encoder error. When OA 
compensation is effected, Fig. 7.4.8, the Y-axis OA coupling induced sinusoid is 
compensated and the Z-axis attitude drift error is essentially removed. The X-axis 
sinusoid error is essentially the table encoder error. 

A comparison of the theoretical and measured pseudo-coning drifts for the 
five oscillatory inputs, presented in Table 7.4.1, indicates the high degree of 
correlation achieved in these tests. 


* 

A complete description of the propagation and effects of pseudo-coning is presented 
in the Final Report, Strapdown System Performance Optimization Test Evaluations 
(SPOT) by Richard Blaha and Jerold Gilmore, R-743, February, 19 73. 
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Table 4. 1. 1 


SIRU Error Propagation Results for Oscillatory Inputs 



Without OA Coupling Compensation 

With OA Coupling Compensation! 

X-Axis 

Oscillatory Inputs 

Approximate Theoretical 
Pseudo -Coning Drift (°/hr) 

— 

Actual Pseudo -Coning 
Drift (°/hr> 

End-to-End Error 
Expressed in°/hr 

Attitude 

(sec) 

15° p-p at 0. 5 Hz 

22.20 

21,75 

o 

w 

o 

16 

20° p-p at 0.25 Hz 

10. 20 

10. 05 

0. 30* 

16 

3/4° p-p at 3.0 Hz 

1. 95 

1.05 

0.30* 

16 

2° p-p at 1. 0 Hz 

2.55 

1.50 

0. 30* 

16 

1/4° p-p at 5, 0 Hz 

0.60 

None Apparent 

0.08* 

4 


Within the quantization uncertainty of the test data 


7.5 Self- Alignment and Navigation Performance Comparisons 

Table 7.5.1 presents standard deviations for latitude, longitude, azimuth and 
leveling of the SIRU system calculated from the one sigma values of drift of the 
SIRU instruments derived from calibration testing* The first data column shows 
alignment and navigation performance calculated from the instrument one sigma 
values over a 6 month uninterrupted operating period. The second data column 
shows alignment and navigation performance based on instrument calibration shifts 
across system cooldown. The calculated results also reflect accelerometer 
performance in the SIRU module configuration. These calculations do not reflect 
the performance improvements that would be attained using the statistical self- 
calibration techniques or the SPC software developed in the SIRU Utilization Program, 
R- 747. Similarly, the calculations are based on the population data, and the 
improvements inherent in the hardware/ software modifications to correct for the 
torque loop H switch polarity (bias) leakage problem (Section 7.3.1) have not been 
factored in. Finally, incorporation of the redesigned gyro, 18 IRIG PM Mod D, 
with its reduced cooldown sensitivities, would yield significant improvements. For 
example, the Mod D bias stability across cooldowns demonstrates improvement by 
a factor of three and the ADI A and ADSRA stability by a factor of six to eight compared 
to Mod B performance. 
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Table; 7. 5. 1 


Projected Alignment and Navigation Performance 




Gyro ler Error Models 


Parameter 

No Cooldowns 
or Mountings 

Across 



(6 Months) 

Cooldown 


NBD (°/hr) 

0.015 

0. 05 

i i c! 

A DO A (°/hr/g) 

0. 005 

0. 01 

a o 
u *n 

ADIA (°/hr/g) 

0. 02 

0.08 

a ts s 

3 « a 

ADSRA (°/hr/g) 

o 

o 

to 

0.06 


Compliance (°/hr/g^) 

0.009 

0. 025 

£ o 

Alignment (sec) 

2. 0 

4. 0 


Scale Factor (ppm) 

10. 0 

22.0 


^ North Axis Drift (°/hr) 

0. 016 

0. 058 

<D 

T3 £ 

East Axis Drift (°/hr) 

0. 013 

0.046 

i?S § 

.a® a 

Vertical Axis Drift (°/hr) 

0. 018 

0. 063 


Latitude Error (nm/hr) 

?jc >)< 

0. 87 

3. 07 

U 4) 

Longitude Error (nm/hr) 

1. 07 

£> 

00 

CO 

PU 

?[< >;e 

Initial Azimuth Alignment (mr) 

1. 18 

4. 15 


Leveling (sec) 

10. 0 

10. 0 


System aligned X-axis down* Y-axis east* Z-axis south 
Slope for first two hours of navigation run 
At SIRU laboratory latitude 


The system performance across cooldowns in alignment using the Mod D is 
projected to be equivalent to 1 mr in azimuth alignment. 

Figures 7.5.1 and 7.5.2 present typical navigation test data for the SIRU system 
taken in the static test condition. A comparison of these plots with the calculated 
latitude and longitude errors of Table 7.5.1 indicates that the one sigma values of 
the static error sources used in the calculations represent a conservative system 
end-to-end performance. 
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8.0 Program Milestone History 

This chapter of the SIRU Development Final Report presents the history of 
the SIRU development as a series of significant milestones extending from May, 
1968 through November, 1971. Subsequent history is summarized in the System 
Log, Volume III of the SIRU Utilization Report, R-747. 

8. 1 Program Initiation 

Technical Proposal 

In May, 1968, the Draper Laboratory in response to NASA RFP 
^BGl 31 -47- 8 - 533P submitted a Technical Proposal to NASA describing a strapdown 
system which would replace certain portions of the Apollo primary Guidance, 
Navigation and Control system as required to support the long term manned space 
flights contemplated for the Apollo Applications Program. 

Contract AAvard 


Work on the SIRU system commenced under contract NAS9- 8242 in June, 1968, 
Delivery called for one developmental modular redundant strapdown system based 
on the dodecahedron geometric concept which, in a production version, would provide 
a capability to perform a 120 day mission with a .999 mission success probability 
followed by a one-half hour reentry phase with .9999 success probability. 

The SIRU design configuration was specified to be compatible with mounting 
in an Apollo spacecraft in the same equipment bay, replacing the Apollo three gimbaled 
IMU. The design was to be compatible with the Apollo vibration and shock environment 
with a vacuum capability using conductive (liquid coolant) heat transfer. In addition, 
the system was to be compatible with a detachable coldplate. 

The gyroscope specified by NASA for the SIRU design was the Draper 
Laboratory designed strapdown instrument, the 18 IRIG Mod B. This unit is a floated, 
single-degree -of- freedom (SDF) gyroscope, magnetically suspended, with a gas 
bearing wheel design and a 5 radian per second slew capability. Built with a permanent 
magnet torquer, it is scaled for torque-to-balance operation with input rates up to 
one radian per second. The accelerometer specified by NASA was the Draper 
Laboratory size 1 6 Permanent Magnet Torquer Pulsed Integrating Pendulous Acceler- 
ometer (PMT PIP A). This unit is a floated, SDF, magnetically suspended specific 
force receiver designed for operation in a torque-to-balance mode. It is distinguished 
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from its predecessor, the Apollo PIP A, by inclusion of a PM torquer, a solid float 
and a more conventional bellows arrangement. 

3. 2 Design and Construction 

Significant program milestones occurring during the design and construction 
of the SIRU engineering model were as follows: 

a) September 1968, Initial Design Review. — The first of the two required 
design reviews with NASA was held September 16-18, 1968. The overall 
SIRU mechanical and electronic design including the computer (DC A) 
was presented and approved. 

b) February 1969, Second Design Review. — The second design review with 
NASA was held at MIT February 4, 6 and 7, 1969. Specific mechanical 
and electronic design features were presented, modification direction 
was received and the plans approved as modified. 

c) May 1969, Contract Review and Evaluation. — An MSC/MIT program 

review was held at MIT on May 6-9, 1969. The principle administrative 
actions were: elimination of the multiplexer from the deliverable 

hardware and approval of the GSE design. 

d) July 1969, SIRU Progress Review. — An MSC/MIT progress review was 
held at MSC, Houston on July 28-29, 1969. Hardware status, completion 
schedules and problem areas were presented and discussed. 

e) January 1970, First Six Position Calibration Test, — On January 27, 1970 
the first six position calibration test was run. The second six position 
test was completed on February 13, 1970. 

f) March 19 70, IBM 360 Plotting Program Implemented. — On March 18, 
1970 the IBM 360 plotting program became operative. Overnight stability 
data is placed on Digistore tape by the MDGO program and then processed 
by the IBM 360. 

g) April 1970, Deletion of Digital Computational Assembly (DCA). — In 
accordance with modification No. 5 to NAS9-8242 the requirement for 
delivery of a breadboard DCA and associated software was eliminated 
as of April 1, 19 70 for budgetary reasons. At that time a breadboard 
simplex model had been constructed, initial instruction capability 
checkout was completed and 60% of the instruction combinations had 
been run and verified. 

h) June 1970, SIRU Assembly and Checkout Completed. — System hardware 
and software are in operating condition ready for NASA "selloff" 
demonstration. 


184 



i) July 1970, NASA Acceptance Testing Successfully Completed. — The 
SIRU demonstration and n selloff n tests were conducted at Draper Labora- 
tory on July 22 - 24 , 1970. The system was accepted subject to correction 
of minor discrepancies and instigation of configuration control. By mutual 
agreement between NASA and MIT, SIRU remained at Draper Laboratory 
to allow a demonstration for industry to be presented in September. 

j) September 1970, Industrial Symposium on SIRU. — An Industrial Sympo- 
sium was presented for space shuttle contractors and other interested 
parties at MIT on September 9-10, 1970. Titled "Design Principles for 
a Modular Redundant Inertial System" it included demonstrations of the 
operating SIRU system. 

k) November 1970, Software Improvements Incorporated. — Attitude algo- 
rithm and failure isolation routines were speeded by 48% at a cost of 
200 memory words. The change permitted improvement in adaptation 
time for a detected failure. Incorporation of the gyro interpolator into 
the attitude algorithm software eliminated pulse bursting in the loop 
performance. 

l) March 1971, Gyro Module Interpolator / Compensator Retrofit Complete. 
— InMarch, 1971, the task of retrofitting all gyro modules with Interpola- 
tor/Compensators was completed. The system had been operating with 
a complete set of retrofitted modules since the first of the year. 

m) November 1971, Close of SIRU Development. — All static and dynamic 
error compensation routines were in successful operation. 
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9* 0 Conclusions and Recommendations 


9, 1 Introduction 

This report has presented the hardware and basic software status of the SIRU 
Redundant Modular Strap down system development program. The SIRU system 
achievements in both hardware and software demonstrate several original applica- 
tions of new technology which represent significant state of the art inertial system 
milestones. Some of the more noteworthy achievements that have been developed 
and successfully demonstrated by the SIRU program are described in the following 
Conclusion section. Recommendations for further development and evaluation of 
the strap down redundant, modularized, fault tolerant guidance and navigation system 
are provided in Section 3,0, Recommendations. 

9* 2 Conclusions 

9. 2.1 Hardware 


SIRU is the first designed, fabricated and test evaluated, integrated, redundant 
strapdown inertial hardware mechanization. It has uniquely evolved and matured 
concepts of redundancy based on dodecahedron geometry. This hardware is free 
from single point failure mechanisms and its fault- tolerant operational features 
have been successfully demonstrated with multiple "hard" and "soft" failures. 

The SIRU, pulse-torqued, strapdown, mechanization has demonstrated wide 
dynamic range (one rad/ sec) with performance equivalent in many dynamic environ- 
ments to that of commercial gimbal systems. During the course of this program 
significant strides in achieving stable and precise strapdown pulse weight scale 
factor and alignment performance were made in both single degree-of-freedom gyro 
and ternary pulse-torque control technology at the system test level, e.g., gyro 
electronics long term scale factor (SF) stability of 10 ppm rms over a six month 
test period (no cooldowns) and 22 ppm rms over two years operation was achieved. 

SIRU represents an initial demonstration of instrument functional modularity. 
Concepts of functional instrument modularity with interchangeable mechanical and 
electrical interfaces, and prealigned and calibrated transferability were implemented, 
matured and demonstrated (e.g., across mountings and cooldowns gyro SF 
repeatability of 30 ppm rms and alignment repeatability of 8 sec rms were achieved 
in system operation). 
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9.2.2 Software, 


SIRU represents the first hardware with an operating, integrated and evaluated 
redundancy management software system. This system includes self-contained fault 
detection and isolation (FDI) with reorganizational processing routines and recertifi- 
cation of "healed" or transient failures. The FDI algorithms have demonstrated 
reliable nonambiguous fault isolation with as many as two gyro and two accelerometer 
measurement axes failures and positive fault detection for a third failure. 

The SIRU program has demonstrated that a comprehensive inertial navigation 
and redundancy management software system for a strapdown dodecahedron redundant 
configuration can be successfully integrated in a representative minicomputer 
(DDP- 51 6) operating at 50 iterations per second (36% machine time) with a reasonable 
memory allocation (7000 16-bit words). This software system includes the strapdown 
processing (twelve instrument static and dynamic compensation, attitude and velocity 
algorithms) redundancy management (FDI, processing, reorganization, etc. ), system 
software . preflight calibration, alignment, ' 1 and navigation), ‘ and operating 
software (dedicated executive, I/O servicing and display). 

Some discussion based on the total SIRU test experience, as it relates to and 
affirms the motivation for a redundant implementation, seems desirable. 

The SIRU equipment, although a first development model, has proven to be 
remarkably reliable (over 20,000 hours of system operation with only 5 hardware 
failures (two of which would typically have been edited out of reliability estimates 
as workmanship or correctable design deficiencies). The fact that these failures 
did occur during the SIRU system testing and that they did not compromise continuing 
system operation is of significance. In each case the processing software automati- 
cally adapted to reflect the failure status and changed the processing structure to 
omit bad data and yield a minimum error propagation solution for continued 
satisfactory system performance. First, from a hardware point of view the failures 
did not result in any systematic degradation, i.e., the redundant hardware features 
retained their integrity and no secondary system operational or performance effects 


* 

During the SIRU Utilization phase of this contract (R-747), third failure isolation 
capabilities were demonstrated for those situations in which a third performance 
failure error magnitude was worse than an already existing and isolated performance 
failure. In addition, the capability to recalibrate and thereby recertify a failure 
that corresponds to a stable performance change was also demonstrated. 

Described in SIRU Utilization Report, R-747. 
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were observed. Second, although several of the failures were of a performance 
degradation type that could not have been detected or isolated by self- monitoring 
electronics typically identified as BITE (Built-in Test Equipment), they were reliably 
detected and isolated by the FDI software algorithms. 

The soft failures that did occur present a broad spectrum of different failure 
mode phenomena, e.g., a random float- freedom gyro problem; a malfunctioning 
preamplifier in the torque loop with attendent variance type data output performance 
and a gyro SF degradation due to a gradually deteriorating solder joint. In a simplex 
triad inertial system implementation, these types of failure modes would, in a space 
mission, probably cause a mission abort. Had the transient failures occurred in a 
critical mission phase, crew safety would probably be endangered. In a prelaunch 
or preflight phase, the transient gyro float- freedom and variance data output failure 
phenomena might possibly have been observed on a coincidental basis. Even if 
observed, verification and isolation diagnostics in the vehicle would be time consuming 
with limited probability of success. In comparison, the SIRU system using real-time 
continuous FDI detected and isolated the failures to the replaceable modular functional 
axes. In each case, as the system repair was being made, the utility and advantage 
of the interchangeable modular instrument module concept was clearly in evidence. 
The faulty instrument module was readily replaced by another module, within the 
tolerance described previously, usually in less than six minutes. 

The motivating need fora redundant system implementation remains apparent 
for missions with time-critical reliability phases or long term missions, as 
characterized by the space shuttle, anticipated satellite space missions and current 
and anticipated commercial and military aircraft operations. The SIRU program 
has demonstrated a realizable and efficient solution to the high reliability ope ration ad 
readiness questions posed by these applications. 

In the final summary the concepts formulated and developed in the SIRU 
dodecahedron redundant modular configuration have been successfully demonstrated 
and matured in both hardware and software. Commitment of strapdown technology 
for a variety of applications is forthcoming and the SIRU performance achievements 
in strapdown technology represent another significant step toward that realization. 

9.2.3 Supplementary Conclusions 

As noted in the introduction of this report, NASA in 1972, subsequent to the 
basic development activity described in this report, funded additional SIRU effort 
to further mature and utilize concepts of redundancy management and to implement 
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other operational features such as preflight single position calibration, self- alignment 
and navigation. This report reflects the achievements in hardware and basic software 
prior to the program extension. Report R-747, a companion report, documents the 
technical concepts and achievements in the development of statistical failure 
detection, isolation, classification and recalibration (FDIC.R) techniques, as well as 
the operational software developments included in the SIRU Utilization program. 

In recognition of the successful outcome of the effort in these areas some 
supplementary conclusionary comment is in order in this report, especially as a 
prelude to any recommendations regarding further coherent redundant system 
technology development. 

Some of the most noteworthy achievements during the additional development 
demonstration effort were: 

1) The implementation of astatistical FDICR technique based onthe"Wald n 
sequential probability test. This technique enabled detection and isolation, 
with a specified coverage (reliability, false and missed alarm 
probabilities), of mean performance shifts at levels equivalent to 1.5 
times the one sigma noise level of normal system operation. For example, 
in a quiescent maneuver environment, the detection and isolation of a 
bias shift as small as 0.07°/hr was routinely achieved with a background 
noise level of 0.045°/ hr. The noise background corresponded to the &9 
quantization in the two minute sampling period. Similarly, performance 
standard deviation changes on the order of four times the nominal spread 
were also detected and isolated. 

The maximum attitude error accumulation prior to detection and 
isolation of a performance failure was bounded at 40 sec independent of 
the magnitude of the performance degradation. Bias and ramp recompen- 
sation to better than .015°/hr and .0008°/hr/minute respectively were 
demonstrated repeatedly for the static environment. Accelerometer bias 
errors of 0.1 cm/ sec and ramp errors of 0.02 cm/ sec /minute in a 

static environment were also detected and bias compensation to 0.02 
2 

cm/sec or less effected. 

2) A single position lumped parameter self- calibration to approximately 
0.015°/hr or better in the static environment was consistently achieved 
using the technique developed and implemented. 
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3) The self- alignment software, implemented in a coarse /fine sequential 
program achieved totally acceptable magnitudes regardless of the envi- 
ronment input during testing. Coarse alignment to less than 1° in a 
fixed 260 second period and fine alignment to less than 1 milliradian in 
15 minutes were consistently attained, 

4) End-to-end performance, demonstrated as the output of a local level 
navigator, was on the order of 0,5 nm/hr or less for all static tests. 

9. 3 Recommendations 


The concepts of redundant modular strapdown technology have been clearly 
demonstrated and matured in the SIRU technology programs documented by these 
reports. The modular hardware implementation and the operating software have 
undergone a comprehensive laboratory evaluation. The obvious and next logical 
evolutionary program step to establish confidence in this technology and to 
demonstrate its unique advantages should be in the commitment of the SIRU system 
to a realistic broad-based flight test evaluation. 

Such a flight test effort should seek to establish a base line for Guidance and 
Navigation performance of the strapdown implementation across the full spectrum 
of flight environments and mission phases. The utility of the redundant implementa- 
tion with its fault tolerant operation and its ability to provide a direct measure of 
its operational readiness represents an important factor to evaluate and demonstrate 
in pre-flight and in-flight operations. Similarly, the logistic and maintenance 
enhancement offered by the comprehensive redundancy, self- test software, and 
hardware modularity should be assessed in an operational environment. With respect 
to the redundancy management design features, both the statistical reliability 
enhancement and the significance of the SIRU dodecahedron's fail-operational 
characteristics in time-critical mission phases can be evaluated and demonstrated. 

Commitment of the SIRU technology to such a test program should be proceeded 
by the integration of the SIRU inertial hardware with a complementary redundant 
computer complex. Development of a special purpose redundant computer system 
does not appear to be realistic technically nor economically feasible. A concept 
based on the utilization of available general purpose computers replicated in triplicate 
with fail-safe input/ output interfacing to achieve fault-tolerant, fail- operational 
mission performance for a single "soft" computer failure represents a practical 
and realizable flight demonstration approach. However, the more challenging and 
basic computer redundancy implementation approach requires the development of a 
high confidence FDI technique for a dual computer complex. For example, in a 
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triplicate system, after the first computer failure, should one abort the mission if 
critical flight safety phases remain? Conversely, can one sufficiently characterize 
potential computer failure modes, as they relate to total system operation, to enable 
the development of a high confidence fail- operational FDI for the remaining duplex 
configuration? At a minimum, the formulation of a suitable dual redundant computer 
complex with special emphasis on a reliable FDI approach and means for re- initializa- 
tion betweeen computers to resolve transient failure phenomena is highly recom- 
mended for integration with the SIRU inertial subsystem. 

Consistent with the integration of SIRU with the computer complex is the need 
to fabricate and integrate a multiplexer interface unit with suitable, triplicate 
computer, expansion capabilities. The original SIRU multiplexer design (not 
fabricated due to program funding limitations) should be reviewed and revised to 
reflect the more advanced state of currently available electronics. The SIRU 
laboratory test experience, the computer complex FDI implementation as formulated, 
and flight operations interactive man- machine considerations should also be reflected 
in the advanced design. The built-in test equipment (BITE) features to be incorporated 
in the multiplexer should complement the software FDI by enabling automatic fault 
location diagnostics to the different axis functions (i.e. # wheel supply, dc axis supply, 
etc.) to optimize system maintenance. 

BITE should also incorporate failure status data display for those hardware 
functions that do not reflect as unique axis failures in the software FDI. This display 
would communicate to the mission operator in real-time the status of the triple 
redundant clocks and dual redundant scalers and 40v power supplies (these redundant 
elements use hardware FDI and active or passive switching provisions in their 
redundant mechanization). 

Within the software area some limited development appears desirable to enable 
a more comprehensive evaluation of possible pilot/ system interfacing. The current 
SIRU executive software is dedicated and non- interactive except for mode switching 
phases, i.e., alignment, navigation, etc. An interactive executive allowing flexible 
examination of different system parameters, modification of compensation loads, 
redundancy in processing conditions and maintenance diagnostics should be developed. 
In addition, the incorporation of the software compensation routines evolved in the 
SPOT program (MIT/DL. Report R-743) for compensation of anisoinertia, SRA cross 
coupling and scale factor linearity appears to be desirable and a review of the OA 
compensation bandwidth characteristics should be effected. 
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In the area of advanced software development, the concepts evolved in the 
SIRU Utilization program can be advantageously matured. Studies to relate the 
FDI criteria automatically to mission phase and dynamics should be conducted and 
corresponding software demonstrations effected. The single- position self- calibration 
technique should be augmented to advantageously utilize optical alignment data as 
well as other alignment aids. The evolution of techniques to apportion drift change 
correction among the bias and g- sensitive coefficients should be initiated. Finally, 
the efficient utilization for flight operations of the total integrated redundant system 
with SIRU and the redundant computer complex as a core structure could be 
advantageously explored. For example, the SIRU sensing datacould also redundantly 
provide flight control and stabilization sensing and attitude and heading display, 
thereby efficiently and reliably replacing a multiplicity of independent sensors. 
The integration of radio -navigation and landing aids with the SIRU concept in a 
redundant implementation should be explored to evaluate total system concepts and 
to develop and demonstrate operational inflight usage of such aids for inertial system 
alignment and compensation improvement. The entire concept of statistical fault 
detection, isolation, classification and recalibration evolved in the SIRU program 
should be reviewed for more comprehensive total guidance, navigation, and control 
system application. 

Several hardware recommendations and studies appear to be desirable. The 
SIRU hardware technology demonstrated modular concepts within the boundaries of 
reasonable physical size and weight allocations that were possible using the electronic 
components and packaging technology of the 1960's. The modularity concept is a 
sound concept, creating both a building block system design and simplified logistic 
and maintenance operations. The application of the technology of the 70 f s (expected 
to include the maturing of medium-scale circuit integration, the advent of realizable 
large-scale integration, and the availability of improved hybrid circuit capabilities) 
to the modular concept would enable realization of a tot ally integrated modular concept. 
A completely self-sufficient instrument module using a single power source and a 
digital data bus concept for input and output could be realized. Preliminary studies 
of such a design using the Charles Stark Draper Laboratory 13 size instrument 
form factor and MSI/ hybrid packaging techniques indicate that an entire SIRU system 
consisting of sixeach accelerometer and gyro self-contained modules (no supporting 
electronic assembly) could be developed in a volume of 0.25 cubic feet which would 
weigh less than 25 lbs. Basic to such a concept however is a second logistic objective; 
to provide in the module interchangeable sensor compatibility features, i.e., ability 
to interface with several different available inertial instruments. Study and 
development in this area as well as in the integrated modular approach is recom- 
mended. 


193 



Finally the continued evolution and improvement of strapdown inertial instru- 
ments is considered most important. The Draper Laboratory 18 IRIG Mod B 
gyroscope has been significantly matured during the course of the SIRU and recently 
Navy sponsored programs. The performance and reliability of the permanent magnet 
version of the 18 IRIG Mod D gyroscope has demonstrated significant potentials 
and should be evaluated for high reliability, high performance, moderate rate 
applications. Similarly, the size 13 gyro and accelerometer technology exhibits 
the ability to accomodate an extremely wide dynamic rate range, in excess of 200°/ sec, 
and to provide moderate drift performance. Even smaller and more promising 
concepts are under investigation. Industrial technology is making similar advances 
and should also be encouraged. The cornerstone of future strapdown technology 
and its acceptance lies in today's instrument development and continued support is 
highly recommended. 
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APPENDIX A 


MATRIX PROCESSOR 
1 . 0 Introduction 

For the six gyros, in the SIRU system, the relationship between angular rate 
inputs M about the selected triad axes and the gyro measurements (m) is conven- 
iently expressed in matrix form in terms of the geometry as 

m = Hb (1) 

where 



and 

c - Cosine of the dodecahedron half angle 
= 0.8506508083 

s “ Sine of the dodecahedron half angle 
= 0.5257311122 

Equation (1) clearly shows the redundant information of the rates about the 
triad axes (X, Y and Z) resident in the SIRU configuration. Data from any three 
gyros (accelerometers) may be used to determine the equivalent triad axis rate 
(acceleration). 

The process structure used to obtain the equivalent triad solutions from the 
dodecahedron array corresponds to a weighted least squares solution form 

b' = (H T ip' 1 H) -1 H T 0' 1 m 
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where b' is defined as the best triad solution estimate and 0 corresponds to a di- 
agonal 6x6 matrix whose terms represent the individual variances. This solution 
provides a best estimate where both the geometric properties of the configuration 
and the individual instrument performance statistics are considered, 

! 

For the SIRU system, weighting of the instruments data was not considered 
applicable and a status matrix X was substituted for 0 h. All diagonal elements of 
X are 1 when all instruments are performing satisfactorily, and the appropriate 
element is set to 0 when an instrument failure is detected. 

In the actual computer mechanization, this is accomplished by storage of 
common constants (Ki,i) which are algebraically used to achieve the appropriate 
least squares solution based on the status of the instruments. 

2.0 Implementation 


To minimize computer operations, the matrix processor depicted in Figure 
A-l was implemented. 



Fig. A-l Matrix Processor 
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Figure A-2 presents an example of the "No Fail M multiply block with the 


desired matrix multiplication included for comparison. The matrix multiplication 
requires a total of 18 multiplys whereas the implemented method requires only 6 
multiply s. | 


OOQ 000 

DESIRED MATRIX MULTIPLICATION: 


~MX 


~ki 

-K1 

-K2 

-K2 

0 

o~ 

MY 

= 

0 

0 

-K1 

K1 

K2 

-K2 

MZ 


K2 

K2 

0 

0 

K 1 

K1 


MA 

MB 

MC 

MD 

ME 

MF 


REQUIRES 18 MULTIPLYS 


IMPLEMENTED: 

MX - K1(MA - MB) - K2(MC + MD) 
MY = K1(MD - MC) - K2(ME + MF) 
MZ = K2(MA - MB) - K1(ME + MF) 


REQUIRES 6 MULTIPLYS 


K1 = -|= 0. 2628655561 
K2 =■£■= 0.4253254042 


FIGURE A-2 NO FAIL MULTIPLICATION 


Figure A-3 compares the implemented manipulation with the desired matrix 
multiplication for an "A-gyro Fail". 
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000 001 


DESIRED MATRIX MULTIPLICATION: 


MX 


0 

-K4 

-K7 

-K7 

K3 

K3 

MY 


0 

0 

-K1 

K1 

K2 

-K2 

MZ 


0 

K8 

-K5 

-K5 

K6 

K 6 


MA 

MB 

MC 

MD 

ME 

MF 

L 


REQUIRES 18 MULTIPLYS 


IMPLEMENTED: 

MX = -K4 MB - K7 (MC + MD) + K3(ME + MF) 
MY = K1(MD - MC) + K2(ME - MF) 

MZ = K8 MB - K5(MC + MD) + K6(ME + MF) 


REQUIRES 8 MULTIPLYS 

K3 = s 2 c/2 
K4 = s 3 
K5 = sc 2 /2 

K6 = s/2 (c 2 + 1) = K1 + K5 
K7 = c/2 (s 2 + 1) = K2 + K3 
K8 = C 3 


FIGURE A-3 A FAIL MULTIPLICATION 

As can be seen by the two examples given, this mechanization is more direct* 
Table A-l summarizes the matrices, constants and multiplys for all possible 
combinations of failures (3 maximum). 
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Number of Failed Instruments 

0 

1 

2 

3 

Totals 

Number of Matrices 

1 

6 

15 

20 

42 

Number of Additional Constants 

2 

6 

12 

2 

22 

Number of Multiplys (Worst CavSe) 

6 

8 

12 

• 9 



" TABLE A- 1 

MATRIX PROCESSOR SUMMARY 


3.0 TABULATION OF CONSTANTS AND MATRICES 


Stored Constants 




. 


Kl: 

0. 2628655561 


Kl 2 : 0. 

0812299241 


K2 : 

0.4253254042 


Kl 3; 0. 

3130684100 


I<3 : 

0. 1175570504 


K14: 0. 

3440954801 


K4: 

0. 1453085056 


- K15: 0. 

3942983341 


K5: 

0. 1902113033 


Kl 6 ; 0. 

5065553283 


K6 : 

0.. 4.530768594 


Kl 7 : 0. 

5567581822 


K7: 

0. 5428824546 


K18 : 0. 

6069610362 


K8: 

0.6155367074 


Kl 9: 0. 

63798810629 


K9: 

0. 5077852523 


K20: 0. 

9820835864 


K 1 0 : 

0. 9510565163 


K21 : 0. 

3632712640 


Kl 1: 

0. 0502028540 


K22: 1. 

5388417686 

Matrices 






0 Fail 

"kt 

-Kl -K2 

-K2 

0 0 



0 

0 -Kl 

Kl 

K2 -K2 

000000 


K2 

K2 0 

0 

Kl Kl 


1 Fail 

0 

-K4 -K7 

-K7 

K3 K3 


A 

0 

0 -Kl 

ki 

K2 -K2 

000001 


0 

K8 -K5 

-K5 

K6 K6 



~K4 

0 -K7 

■K7 

-K3 -K T 


B 

0 

0 -Kl 

Kl 

K2 -K2 

000010 


K8 

0 K5 

K5 

K6 K6 
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K6 

-K6 

0 

-K8 

K5 

-K5 


K3 

-K3 

0 

K4 

K7 

-K7 

000100 

K2 

K2 

0 

0 

K1 

K1 


K6 

-K6 

-K8 

0 

-K5 

K5 


-K3 

K3 

-K4 

0 

K7 

-K7 

001000 

K2 

K2 

0 

0 

K1 

K1 



K1 

-K1 

-K2 

-K2 

0 

0 


K5 

K5 

-K6 

K6 

0 

"K8 

010000 

K7 

K7 

-K3 

K3 

0 

K4 


K1 

-K1 

-K2 

-K2 

0 

0 


-K5 

-K5 

-K6 

K6 

K8 

0 

100000 

K7 

K7 

K3 

-K3 

K4 

0 



2 Fail 


A, B 


0 0 -K9 -K9 0 0 

0 0 -K1 K1 K2 -K2 


0 


0 0 K10 KIO 


OOOOll 


C, D 


KIO 

0 

K2 


-KIO 0 0 0 

0 0 0 K9 

K2 0 0 K1 



-K9 

K1 


001100 


E, F 


K1 -K1 -K2 -K2 0 0 

0 0 -KIO KIO 0 0 


K9 K9 0 


0 


0 



110000 


-K13 

0 

-K20 

K17 

-Kll 


-K12 

0 

Kll 

K19 

-K16 

000101 

K17 

0 

-K14 

K18 

K15 



A-6 




0 

-K13 

-K20 

0 

-Kll 

K17 


A, D 

0 

K12 

-Kll 

0 

K16 

-K19 

001001 


0 

K17 

-K14 

0 

K15 

K18 



0 

-Kll 

-K19 

-K1 6 

0 

K12 


A, E 

0 

K14 

-K18 

K15 

0 

-K17 

010001 


0 

K20 

-K17 

-Kll 

0 

K13 



0 

-Kll 

-K16 

-K19 

K12 0 


A, F 

0 

-K14 

-K15 

K18 

K17 0 

100001 


0 

K20 

-Kll 

-K17 

K13 0 



K13 

0 

0 -K20 Kll 

-K17 


B, C 

K12 

0 

0 Kll K16 

-K19 

000110 


JC17 

0 

0 K14 K15 

K18 



K13 

0 

-K20 

0 -K17 

Kll 


B,D 

-K12 

0 

-Kll 

0 K19 

-K16 

001010 


K17 

0 

K14 

0 K18 

K15 



Kll 

0 

-K16 

-K19 

0 

-K12 


B,E 

K14 

0 

-K15 

K18 

0 

-K17 

010010 


K20 

0 

Kll 

K17 

0 

K13 



Kll 

0 

-K19 

-K16 

-K12 0 


B, F 

-K14 

0 

-K18 

K15 

K17 0 

100010 


K20 

0 

K17 

Kll 

K13 0 



K18 

-K15 

0 

-K17 

0 

-K14 


C,E 

K17 

Kll 

0 

K13 

0 

-K20 

010100 


K19 

K16 

0 

K1 2 

0 

Kll 



— 
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- K15 

-K18 

0 

K17 

K14 

0 


-Kll 

-K17 

0 

K13 

K20 

0 

100100 

K16 

K19 

0 

■K12 

Kll 

0 


K15 

-K18 

-K17 

0 

0 K14 


Kll 

K17 

-K1 3 

0 

0 -K20 

011000 

K16 

K19 

-K12 

0 

0 Kll 


K18 

-K15 

-K17 

0 

-K14 

ol 


-K17 

-Kll 

-K13 

0 

K20 

0 

101000 

K19 

K16 

K12 

0 

Kll 

0 



3 Fails 








— 



0 

0 

0 -2K9 K21 

-K21 



A, B.C 

0 

0 

0 

0 K9 

-K9 


000111 


0 

0 

0 

0 K10 

K10 

_ 



fo 

0 

-2K9 

0 

■K21 

K21 

— 


A, B, D 

0 

0 

0 

0 

K9 

-K9 


001011 


L° 

0 

0 

0 

K10 

K10 

— 

1 

1 

0 

0 

-K9 

-K9 

0 

0 



A, B, E 

0 

0 

-K10 

K10 

0 

0 


010011 


0 

0 

-K22 

K22 

0 

2K10 

— 




0 

-K9 

-K9 

0 

0 



A, B, F 

0 

0 

-K10 

K10 

0 

0 


100011 


0 

0 

K22 

-K22 

2K10 0 

— 



“o 

- 

2K10 0 

0 

K22 

K22 

— 


A, C,D 

0 


0 0 

0 

K9 

-K9 


001101 


0 


0 0 

0 

K10 

K10 
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0 0 

-K9 

-K9 0 

0 


A, E, F 

0 0 

-K10 

K10 0 

0 . 



■0 2K9 -K21 

-K21 0 

0 




2K10 

0 0 0 

-K2 2 

-K22 


B, C,D 

0 

0 0 0 

K9 

-K9 



0 

0 0 0 

K10 

K10 




0 

0 -K9 

-K9 0 

0 


b.e.f 

0 

0 -K10 

K10 0 

0 



2K9 

0 K21 

K21 0 

0 

— 


K10 

-K10 0 

0 0 

0 


C.D.E 

K21 

K21 0 

0 0 

2K9 



K9 

K9 0 

0 0 

0 

— 


K10 

-K10 0 

0 0 

0 

— 

C.D.F 

-K2 1 

-K21 0 

0 2K9 

0 



K9 

K9 0 

0 0 

0 



K10 

-K10 0 

0 0 

0 

— 

C, E, F 

K22 

-K22 0 

2K10 0 

0 



K9 

K9 0 

0 0 

0 



~ K10 

-K10 

0 0 

0 

0~ 

D, E, F 

-K22 

K22 -2K10 0 

0 

0 


K9 

K9 

0 0 

0 

0 



0 

K9 

0 

-K22 

0 

-K10 

A, C, E 

1 0 

K10 

0 

-K9 

0 

-K22 


0 

K22 

0 

-K10 

0 

-K9 


110001 


001110 


110010 


011100 


101100 


110100 


111000 


010101 
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0 

-K21 

0 

-KIO 

K9 

0 


A.C.P 

0 

-K9 

0 

K21 

KIO 

0 

100101 


0 

KIO 

0 

-K9 

K21 

0 



0 

-K21 

-KIO 

0 

0 

K9 


A, D, E 

0 

K9 

-K21 

0 

0 

-KIO 

011001 


0 

KIO 

-K9 

0 

0 

K2Jj 



0 

K9 

-K22 

0 

-KIO 

-H 

o 


A, D,F 

0 

-KIO 

-K9 

0 

K22 

i 

0 

101001 


JO 

K22 

-KIO 

0 

-K9 




K21 

0 

0 - 

KIO 

0 

K9 


B, C,E 

K9 

0 

0 

K21 

0 

KIO 

010110 


K10 

0 

0 

K9 

0 

K21 



-K9 

0 

0 

-K22 

KIO 

0 


B, Cj F 

-KIO 

0 

0 

-K9 

K22 

0 

100110 


K22 

0 

0 

KIO 

-K9 

0 



-K9 

0 

-K22 

0 

0 

KIO 


B, D,E 

KIO 

0 

K9 

0 

0 

-K22 

011010 


K22 

0 

KIO 

0 

0 

-K9 

1 


— 









K21 

0 

-KIO 

0 

-K9 

0 


b.d.f 

-K9 

0 

-K21 

0 

KIO 

0 

101010 


KIO 

0 

K9 

0 

K21 

0 
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Appendix B 


Gyro and Accelerometer Compensation Algorithms 


This appendix provides a descriptive review of the gyro and accelerometer 
compensation algorithms. 


Figure B-l illustrates the sequence of compensation and the flow of compensated 
data through the matrix processor. 



Fig. B-l Compensation Software Flow Chart 


The first step in gyro compensation adds the finer quantization information 
from the gyro interpolator electronics to the accumulated gyro pulses. This added 

f \ 

information reduces the loop quantization from 44 sec to approximately 5.5 sec per 
pulse. 


The resulting raw attitude datais scaled by the gyro scale factor to determine 
the input axis angular rotation. Scaling is accomplished by first sizing the 
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accumulated pulses to a nominal scale factor (an even power of 2 for computational 
efficiency), and then, correcting for the deviation of the true scale factor from the 
nominal value. The scale factor correction is determined for each gyro from the 
calibration test data and stored in memory by a load making program. 

Bias di ift (NBD) is compensated with incremental corrections applied to the 
gyro pulse count. The magnitude of the correction is derived from the NBD calibration 
value (from static test) applied to the compensation iteration period. 

Acceleration sensitive drift components (ADIA, ADO A, ADSRA, and major 
compliance) are corrected by triad referenced acceleration estimates derived from 
the accelerometer outputs. The gyro drift error magnitudes are calibrated using a 
six position procedure (discussed in Chapter 4), but are rescaled to the triad frame 
for compensation purposes. Thus, the accelerometer derived velocity increments 
m the triad frame are applied directly to effect the appropriate correction to the 
accumulated gyro pulses. The magnitude of correction is dependent on the drift 
error magnitude, the velocity increment estimate, and the iteration period. Since 
the correction is based on triad referenced velocity data, the compensation scheme 
is independent of first instrument failure and therefore is redundant. 

Output axis coupling drift errors result from a lagging float motion in response 
to rate changes about the output axis (OA). Hence, extra torque pulses will occur 
to maintain the float at its null position as the gyro case is accelerated. Compensation 
is accomplished by using angular estimates about the OA of each gyro. These 
acceleration estimates are derived directly from the body triad data (XYZ) since 
each gyro's OA is colinear with the reference triad. The magnitude of the 
compensation is determined by weighing the OA rate change estimates by the gyro 
parameter ratio 1/ H (moment of inertia about OA divided by wheel angular momentum). 

Spin axis cross coupling and the anisoinertia drift errors result from 
simultaneous rates applied about the input axis (IA) and the spin reference axis 
(SRA). For the 18 IRIG Mod B gyro the anisoinertia magnitude is approximately 
equal and of opposite effect to the spin axis cross coupling error. Thus, the two 
error sources cancel in the propagation of attitude errors. These error sources, 
while correctable, are not compensated in SIRUat this time. 

Gyro misalignment angle errors are compensated by subtracting from the 
gyro pulse count the product of the estimated rate derived from the triad referenced 
vectors and the fixed misalignment (determined from dynamic test). The gyro 
misalignment calibration is obtained by each individual instrument referenced to 
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the dodecahedron frame. However, for compensation purposes, the alignment 
magnitudes are projected to the triad configuration such that the triad derived rate 
estimate can be applied directly in the compensation process. The additional 
component of OA misalignment error, which represents the effect of float hangoff 
due to the applied input rate, is lumped with the dynamic error term (spin axis 
cross coupling) described above. 

Accelerometer Compensations 

The accelerometer accumulated pulse data is scaled to determine the magnitude 
of the velocity increment. An average scale factor, based on positive and negative 
acceleration input calibrations, is used. 

Accelerometer bias is compensated by adding increments to the pulse count. 
The magnitude is based on the bias magnitude (from static test) and the duration of 
the compensation interval. 

The accelerometer misalignment angles are fixed quantities dependent on the 
mounting alignment and determined by calibration tests. Misalignment errors are 
corrected by subtracting the estimated acceleration errors due to the misalignments 
from the input accelerometer pulse count. 

2 

Centripetal acceleration (Ru> ) and tangential acceleration (Rcl>) normalization 
is required because of the dispersed locations of the individual accelerometers. 
Ideally, the mass elements of all accelerometers should be located at a single point. 
Since this condition is obviously impossible to obtain, corrections are introduced 
to account for the distance from an assumed single point to the actual location of 
each accelerometer mass element. The error correction is computed from this 
distance, the body angular rate, and the change in rate over the compensati on interval. 
In SIRU, the A accelerometer mass element is the single point reference. 

Accelerometer OA coupling, pendulous axis cross coupling and the G 2 error 
terms do not introduce substantial system errors and are not compensated in SIRU. 

A complete software documentation package including detailed software 
flowgrams and descriptions is presented separately as Volume III of this report. 
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APPENDIX C 


GYRO AND ACCELEROMETER MODULE SPECIFICATIONS 


The principle parameters of the gyro and accelerometer modules as 
implemented for the SIRU system are specified in this appendix. They represent 
performance consistent with the goals contained in the original NASA Statement of 
Work and subsequent cost effective design tradeoffs. Design descriptions of the 
individual circuits and the module connector pin listings are provided in Volume II 
and Volume IV, respectively. 

1. Gyro Module 


a) Scale Factor (SF) Nominal Parameters 


AO Pulse 

SF Decay Characteristics 

Interrogation Rate (Max Pulse Rate) 
Loop Torque Rate Capability 
Torquer Duty Cycle 

Stability 

Stabilization Time 
SF Linearity 
SF Thermal Sensitivity 
SF Voltage Sensitivities 
PVR Supply 
40v Supply 

SF Dynamic Sensitivity 

Radial Displacement 
Axial or Radial g Loading 


-IS -14 - 1 /~\ 

2 + 2 1 + 2 10 radians = 44.1 sec 

Nominal 40 ppm/decade, maximum 

60 ppm/decade 

4800 pps ±1/2 ppm = F^ 

1.025 rad/ sec (1.0 minimum) 

(15/16) ( 1 / F ^ ) = 195 microseconds 

of 208 microseconds 

0.25 rad/ sec in 24 hours (15 ppm p-p) 

One hour 

± 30 ppm p-p 

1/2 ppm/°F 

1 ppm/. 05% 

1 ppm/1% (within ±5% range) 

25 ppm/rad/sec about O A 
5 ppm/g 
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b) I A Alignment Stability 


Thirty day stability with 3 room temperature cooldowns 5 sec (rss) 
Alignment Repeatibility (removal and replacement) 10 sec (rss) 

c) Operational Characteristics 


Power Supply Characteristics 


DC Source Level Load (Max) Ripple 


1. 

40.0 vdc ± 0.4 vdc 

165 ma 

<0.43 v 

rms 

2. 

15.000 vdc ± 0.008 vdc 

11 ma 

<0.002 v 
, rms 

3. 

-10.0 vdc ± 0.5 vdc 

25 ma 

<0.140 v 

rms 

4, 

10.0 vdc ±0.5 vdc 

25 ma 

<0.140 v 

rms 

5. 

5.25 vdc ± 0.25 vdc 

140 ma 

<0.1 v 

rms 

6. 

28 vdc ± 3 vdc 

750 ma 

<0.5 v 

rms 

7. 

28 vdc ± 0.5 vdc 

55 ma 

<0.3 v 

rms 

8. 

-20 vdc ±1.0 vdc 

25 ma 

<0.2 v 

rms 


b. AC 


1. 9600 Hz, 8.0 v rmg ± 1%, 2.5 watts max, harmonic content < 2% sine 
wave 

2. 800 Hz, 2 phase, 28 ^ TTns ± 5%, 2.6 watts max each phase, phase A 
leads phase B by 90° ± 0.5°, harmonic content < 20% 

3. 9600 Hz and 800 Hz signals in synchronization 
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Timing Pulse Characteristics 


Interrogate pulse 
Amplitude 
Width 

Repetition Rate 
Switch pulse pair 
Amplitude 
Width 
Spacing 

Repetition Rate 

Lag of reset pulse to interrogate pulse 


5 vdc amplitude, 2 microseconds width 
4.5 ± 0.5 vdc amplitude, 0 to 31 pulses 
at 1.5 me rate, 200 nanoseconds width, 
first pulse starts 10 microseconds 
± 1 microsecond after interrogate pulse 
leading edge 

4, 5 ± 0.5 vdc amplitude, 200 nanoseconds 
width, 208.33 microseconds repetition rate, 
pulse occurs 31.34 microseconds after 
interrogate pulse leading edge. 


1. PVR power test point 

2. Single ended SG monitor point, 1250 mv/milli radian of angular input 
about IA at 9 600 Hz 

3. SF resistance test point 

4. Gyro temperature sensor #4, 500 ohms ± 0.5 ohms at operating 
temperature (+.00226 ohms / ohm /°F). 

5. DC amplifier test point 


Output Signal Requirements 

AS pulses 
Interpolator pulses 

Interpolator end- of- data pulse 
Monitoring Line Identification 


4.5 ± 0.5 vdc 
0.4 microseconds 
4.8 kpps 

4.5 ± 0.5 vdc 
0.4 microseconds 
13 microseconds 
4.8 kpps 

2 microseconds ±1/2 
microseconds 
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Auxiliary Input Requirements 


1. 0 to 28 vdc at 0 to 0.4 amp (for adjustable fixed heat when used with 
GSE only). 

2, Frequency and Timing Accuracy and Stability — All ac input voltage 

frequencies and input signal repetition rates are derived from a clock 

8 

whose basic frequency is 3.6864000 mega Hz ± 1 part in 10 with a 

7 

stability of ±3 parts in 10 per week. 

Thermal Characteristics 


Nominal Thermal Dissipation 
Thermal Dissipation Limits 
Nominal Average Module 
Mounting Pad Temperature 


Temperature Control Range 


21.5 watts 
17 watts to 30 watts 

105°F 

Max p'p deviation between pads and average temperature 
±3°F 

(at 70°F nominal free air 

ambient & 1/2 inch insulation) 60° to 110°F 


2. Accelerometer Module 


a) Operational Characteristics 

Power Supply Characteristics 


DC 

Source Level 

Load (Max) 

Ripple 

1 . 

28.0 vdc ± 0.3 vdc 

100 ma 

°- 07v rm S 

2. 

15.000 vdc ± 0,008 vdc 

11 ma 

°- 002 Vs 

3. 

-10.0 vdc ±0.5 vdc 

25 ma 

0.140 v 

rms 

4. 

10.0 vdc ± 0,5 vdc 

25 ma 

0.140v e 
rms 

5. 

5.25 vdc ± 0.25 vdc 

140 ma 

0.1 v 

rms 

6. 

28 vdc ± 3 vdc 

750 ma 

0.5 v 

rms 
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AC 


b. 


1. 9600 Hz, 4.0 v ± 1%, 1.6 watts, maximum harmonic content <2%. 

Sine wave synchronized to interrogator pulse train. 

Timing Pulse Characteristics 


Interrogate pulse 
Amplitude 
Width 

Repetition Rate 
Switch pulse pair 
Amplitude 
Width 
Spacing 

Repetition Rate 


4.5 ± 0.5 vdc 
4 microseconds 
4.8 kpps 

4.5 ± 0.5 vdc 

0.4 microseconds 
13 microseconds 
4.8 kpps 

2 microseconds ±1/2 
microseconds 


Lag of reset pulse to interrogate pulse 


Output Signal Requirements 

AV pulses 5 vdc amplitude, 2 microseconds width 
Monitoring Line Identification 

1. PVR power test point 

2 . Single ended SG monitor point — 400 mv/ milli radian rms about OA at 
9600 Hz. 

3. Scale factor resistance test point 

4. Accelerometer temperature sensor #4 — 500 ohms ± 0.15 ohms at 
operating temperature (+00226 ohms/ ohm/ °F). 

5. DC amplifier test point. 

Auxiliary Input Requirements 


1. 0 to 28 vdc at 0 to 0.4 amps (available for adjustable fixed heat when 
used with GSE only). 

2. Frequency and Timing Accuracy and Stability — All ac input voltage 
frequencies and input signal repetition rates are derived from a clock 

Q 

whose basic frequency is 3.6864000 mega Hz ± 1 part in 10 with a 

7 

stability of ± 3 parts in 10 /week. 
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APPENDIX D 


The SIRU system software has been described in Chapters 2 and 4 of this 
volume. Volume III of this report contains detailed descriptions of the software, 
listings of the subroutines and load maps. This appendix is a precis of Volume III* 


The principal programs and the tasks which each software element addresses 
(see Section 4.3,3) are shown in Table D-l. The indicated page number refers to 
the full description in Volume III. A short description of each program follows. 

Table D-l Software Program Listing 


Program 


Task 


Page 


M PRO 

ALPO 

SFPOUT 

SXOU 

50GS 

READ 

ACOM 

GCOM 

OCMT 

DCOA 

ROMS 

PREX 

GARC 

GFIS 

ERDE 

CFSE 

PFIS 

GPRT 

PRTY 

PPEX 

GMIN 

GPMA 

EMIN 

MG63 


} 


} 

} 


MV63 

SPUN 

VESP 

VACU 

ERC6 

AA6S 


Main Program 


Output 

Al, G1 
A2 

G2 

A3 

A4 

G3 

G4 

A5 

G5 

A6 

G6 

A7 

G7 

A8 

A9 

A10 

All 

G8 

G9 


7 

20 

31 

36 

39 

43 

47 

52 

61 

65 

69 

78 

81 

87 

93 

99 

112 

115 

118 

123 

125 

128 

138 

140 

146 

149 

158 

169 

171 

174 
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The main executive of the system operating program (MPRO) calls the 
appropriate subroutines toaccomplish the algorithms shown in Fig. 4.3.3 of Chapter 
4 and the system tasks listed there It is divided into three sections. The first is 
initialization and the enabling of interrupt. Next is a waiting loop which checks to 
see if it is time for output and, if so, calls the proper output routines. When this 
waiting loop is interrupted (every 5 milliseconds), the program sequence goes to 
the third section which decides when the time has come to update the accelerometer 
or gyro algorithms, retains the processing registers as they were at the time of 
interrupt, calls the appropriate algorithms, restores the processing registers and 
returns to whatever was being processed at the time of interrupt. 

The subroutines which accomplish these various activities are identified and 
described briefly as follows. 

ALPQ 


ALPO provides system status information formatted as shown in Fig. 4.3.4 
of Chapter 4 on teletype, CRT screen or as a block of 104 bytes on Digistore tape. 

SFPQUT 


SFPOUT and OUTIOO provide the ALPO information in decimal numbers and 
seconds of time. 

5XOU 


This routine determines whether the AL.FO information is displayed on teletype 
or CRT screen. 

SDGS 


This routine causes the information to be written onto the Digistore tape. 


READ 


READ causes either the gyro and accelerometer interface to interrupt the 
main program every 5 milliseconds. These interruptions start with the accelerometer 

and alternate between the accelerometer and the gyro. At each interruption the six 

~ 6 

appropriate pulse counters are read and the contents stored. Scaling is 2 pulses 

- 15 

which represents 1 pulse AV as 4 cm/ sec and 1 pulse A0 as 7x2 radians. 
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A COM 


This subroutine compensates each accelerometer output for scale factor, bias 
and two misalignments* 

GCOM 


GCOM compensates each gyro output for SF, NBD, ADIA, ADOA, ADSRA major 
compliances and OA coupling, 

DCMT 


This subroutine modifies the misalignments of the gyro about the output axis 
as a function of the measured input rate at each update. The information is stored 
in the base sector where it is available for the gyro compensation program. 

DCOA 

DCOA calculates a compensation for the error resulting from the effect of a 
rotational input on the output gyro axis. 

ROMS 


When a strapdown system is subjected to a rotational input, accelerometers 

2 

will sense acceleration due to R w and Ru). Since the several accelerometers do 
not sense these rotations at the same point, they will appear to be in disagreement 
one to another. ROMS compensates the output to represent the origin as a single 
point. For convenience, the center of accelerometer A is the chosen single point 
which makes it necessary to compensate only the other five instruments. 

GA3C . 


This subroutine accumulates the six compensated gyro pulse counts and stores 
them for the squared error calculation. It also accumulates the total of the change 
in count for use in GFIS. 

PREX 


PREX accomplishes the same operation for accelerometers as GARC performs 
for the gyros. 
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GFIS 


This subroutine controls the logic for the gyro FDI procedure. Once every 
update it decides which failure should be searched for by consideration of the gyro 
fail status and identification from the previous search. It then stores the maximum, 
allowable total squared error for either the first or second failure search. 

ERPE 


ERDE is called up by either the gyro or accelerometer FDI logic and provides 
the information required to identify the failure. 

CFSE 

This subroutine calculates either the first or second squared error terms 
for instruments from the set of accumulated measurements, decides whether the 
total squared error exceeds a certain limit and, if it does, decidesif any instruments 

squared error exceeds a certain percentage of the total. If the calculations show 

12 24 

an error equalling or exceeding 2 pulses or the total squared error exceeds 2 

an indication is provided that the calculations could not be completed due to huge 

errors in one or more instruments. 

PRIS 

This subroutine controls the logic for the accelerometer FDI procedure and 
is substantially the same as GFIS. The accelerometer maximum allowable squared 
errors are not modified prior to this operation as is the case of the gyro GFIS. 

GPRT 

This subroutine is a further extension of the gyro FDI. It determines the 
failure status and identifies the proper parity equations to solve. 

PRTY 


PRTY solves the proper parity equations to provide detection for a third gyro 
failure. 

PPEX 


This subroutine is the accelerometer equivalent of the PRTY routine for gyros. 
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GMIN 


GMIN, using the gyro fail status instructions from the gyro least-squares 
matrix generator, calculates which of the 22 matrices to generate. 

GPMA 

This subroutine is the least-squares matrix generator for gyros and ac- 
celerometers. 

EMIN 

EMIN is the accelerometer equivalent of the gyro GMIN subroutine. 


MG63 


This subroutine performs the 6x3 matrix multiplications which transform the 
six gyro AG outputs into the XYZ frame. 

MP63 


MP63 is the accelerometer equivalent of the gyro MG63 subroutine. 


SPUN 


This subroutine corrects the quaternion to maintain it at a unity value, i.e. 

X 2 + P 2 + P 2 +P 2 = 1 
x y z 


VESP 


This subroutine constructs a cosine matrix from the quaternion, transforming 
a vector in the body frame to the inertial frame. It then multiplies the AV in the 
body frame by this matrix to transform AV into the inertial frame. 

VACU 


VACU accumulates delta velocity in the inertial frame. 
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ERC6 


This subroutine accomplishes the equivalent of torquing a gyro in a gimbal 
IMU. It essentially compensates the gyro for a drift in the inertial frame and is 
used to take out earth rate. It does this compensation by transforming the negative 
of the drift in the inertial frame into the body frame by adding it to the gyro output 
as an equivalent NBD. 

AA6S 

AA6S performs a third order attitude algorithm to update the quaternion of 
rotation. 
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